f74250d8a3
feat: add UNDF-2026-000001266 (salt-0004) and UNDF-2026-000001267 (ansible-0004) CWE-1333
...
Salt pcre/grain_pcre targeting passes user-controlled regex to re.match/re.compile
without timeout. Ansible inventory manager passes tilde-prefixed host patterns
directly to re.compile. Both fixed with ThreadPoolExecutor 1s timeout wrapper.
2026-04-13 09:56:20 -04:00
7f280e8187
registry: assign UNDF IDs 1259-1265 for lean4-0001..0007
2026-04-13 09:30:06 -04:00
716ef7cb2d
undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)
2026-04-05 19:46:54 -04:00
fdbb9a1aa9
redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
...
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00
6147f0bd5a
undf: assign UNDF-2026-000001230 (zebra-0001); stamp patch
2026-04-03 18:05:44 -04:00
de09497fb3
undf: assign UNDF-2026-000001224..000001229 (systemd-0004, dbus-0001, mysql-0005, proxysql-0002 +2); stamp patches
2026-04-03 15:58:23 -04:00
9ee6cc0d71
undf: assign UNDF-2026-000001218..000001220 (jicofo-0001/0002, langchain-0002); stamp patches
2026-04-03 15:17:17 -04:00
43e0ed15f1
undf: stamp patches (kdenlive-0010, krita-0001/0002); gitignore minecraft server artifacts
2026-04-03 15:06:14 -04:00
d71880e9ba
rawtherapee: 5-MOAD scan wave 2; rawtherapee-0002 CWE-407 IPTC panel delKeyWord/delSuppCategory O(K*S) selection scan, 94x at K=1000; shotcut CLEAN (no new defects beyond 0001)
2026-04-03 14:40:19 -04:00
77ffbdbd57
undf: assign UNDF-2026-000001208..000001211, stamp patches (evince-0001, zathura-0001)
2026-04-03 14:34:04 -04:00
358360d744
undf: assign UNDF-2026-000001206..000001207, stamp patches (cura-0002, prusaslicer-0004)
2026-04-03 14:16:55 -04:00
e8396e9310
undf: assign UNDF-2026-000001196..1205; stamp openscad-0002/0003, suitecrm-0005/0006, calibre-0003/0004, invoiceninja-0004/0005, xtuple-0001
2026-04-03 14:10:53 -04:00
1fda7b64d3
undf: assign UNDF-2026-000001193..1197 to suricata-0002, squid-0004, clamav-0001, pgbouncer-0002, sendmail-0001; stamp patches
2026-04-03 13:31:17 -04:00
01f059fa4b
undf: assign UNDF-2026-000001190 through UNDF-2026-000001192, stamp patches
2026-04-03 13:25:03 -04:00
5e1c00c890
undf: assign UNDF-2026-000001184 to dnsdbq-0001, stamp patch
2026-04-03 13:06:09 -04:00
93c9c175d4
undf: assign UNDF-2026-000001125 to mercurial-0001, stamp patches
2026-04-03 11:04:23 -04:00
cb3ee91292
undf: assign 1040-1056; stamp emulator wave patches (hatari/fceux/sameboy/duckstation/pcsx2/mupen64plus/mednafen/vice/fbneo/dolphin/genesis-plus-gx/ryujinx/cemu/fs-uae)
2026-03-31 18:18:58 -04:00
2a0a635c74
undf: assign 1013-1039; stamp patches (samba/juicefs/ipfs-cluster/nfs/rclone/lotus/speed-dreams/seaweedfs wave)
2026-03-31 13:27:38 -04:00
9fac7766ba
wesnoth: 3 CWE-407 defects, MOAD 0002-0005 CLEAN
...
wesnoth-0001: A* pathfinding std::find on pq vector for decrease-key
O(V*Q) per relaxation, fix: lazy deletion. HIGH, 1279x at N=5000.
wesnoth-0002: server ip_log_ deque linear scan on login/logoff
O(N) per event with N up to 500. MEDIUM, 437x at L=2000.
wesnoth-0003: combine_special_notes O(N^2) vector dedup
utils::contains on vector per note insertion. MEDIUM, 499x at N=1000.
MOAD-0002 (Intertangle): singletons deeply embedded, not actionable.
MOAD-0003 (Leaked Context): thread_local for debug/call-stack only.
MOAD-0004 (Logged Secret): passwords never logged verbatim.
MOAD-0005 (Thundering Herd): single-threaded game + coroutine server.
6/6 unit tests PASS.
2026-03-31 12:14:20 -04:00
1b98cac200
cocos2d-x: 3 CWE-407 defects, MOAD 0002-0005 CLEAN
...
cocos2d-0001: EventDispatcher _toRemovedListeners std::find O(L*R) MEDIUM 2.4x
cocos2d-0002: PhysicsWorld collisionBeginCallback std::find O(J_body*J_world) MEDIUM 11.6x
cocos2d-0003: BoneNode::visit _boneSkins.contains O(C*S) per frame MEDIUM 7.3x
MOAD-0002 (Intertangle): heavy singleton pattern (Director, etc.) but architectural, not patchable
MOAD-0003 (Leaked Context): no thread_local usage, CLEAN
MOAD-0004 (Logged Secret): no credential logging, CLEAN
MOAD-0005 (Thundering Herd): TextureCache uses unordered_map, CLEAN
6/6 unit tests PASS.
2026-03-31 12:10:19 -04:00
b3e48a3ca1
undf: assign 967-968; stamp openttd patches
2026-03-31 12:09:45 -04:00
223ccb3fee
0ad: 4 defects, 5-MOAD scan across pathfinding/visibility/templates/lobby
...
0ad-0001 CCmpObstructionManager dirty shapes vector+std::find O(N*D) HIGH 4.1x
0ad-0002 CCmpRangeManager m_ModifiedEntities vector+std::find O(E*M) HIGH 25.8x
0ad-0003 CCmpTemplateManager FindUsedTemplates vector+std::find O(T^2) MEDIUM 5.9x
0ad-0004 XmppClient+NetServer lobby auth token logged verbatim CWE-312 MEDIUM
MOAD-0002 (Intertangle): g_ globals are deliberate single-thread game arch, CLEAN
MOAD-0003 (Leaked Context): thread_local properly scoped, CLEAN
MOAD-0005 (Thundering Herd): single-threaded sim, no cache stampede, CLEAN
4/4 unit tests PASS, UNDF 956-959
2026-03-31 11:58:37 -04:00
b7340f0b9b
undf: assign 954-955; veloren-0001 TradePricing O(N^2) CWE-407, veloren-0002 auth token logged CWE-312
2026-03-31 11:48:12 -04:00
9335217e94
jellyfin-0001/jellyfin-0002: Jellyfin 5-MOAD scan
...
jellyfin-0001 (CWE-407): BaseNfoSaver AddCustomTags xmlTagsUsed List.Contains
O(E*T) per NFO save, fix HashSet O(E). 24.6x at T=50,E=200. UNDF-2026-000000952.
jellyfin-0002 (CWE-312): Logged secrets in SessionManager (access token),
SchedulesDirect (auth token), QuickConnectManager (secret). 3 sites. UNDF-2026-000000953.
MOAD-0002 (Intertangle): CLEAN. No god object pattern detected.
MOAD-0003 (Leaked Context): CLEAN. AsyncLocal only for deadlock detection.
MOAD-0005 (Thundering Herd): CLEAN. FastConcurrentLru with GetOrAdd.
2026-03-31 11:46:30 -04:00
f85ccf9b99
open-webui-0001: CWE-312 logged secret in PersistentConfig Redis sync
...
AppConfig.__getattr__ logs raw decoded values when config keys change
via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+
other API key/token/password PersistentConfig entries. Fix: redact
values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist.
13/13 PASS
2026-03-31 11:43:57 -04:00
a7907f0e12
supertuxkart-0001: item_manager randomItemsForArena O(N^2) invalid_location scan
...
CWE-407 defect in src/items/item_manager.cpp:635. std::find on
std::vector<int> invalid_location inside retry loop inside placement
loop. Fix: std::unordered_set<int> for O(1) membership. 13.8x at N=500.
MOAD-0002 through MOAD-0005 scanned CLEAN:
- MOAD-0002 (Intertangle): standard game engine singleton pattern
- MOAD-0003 (Leaked Context): thread_local g_process_type is process-scoped
- MOAD-0004 (Logged Secret): HTTP request logging already has credential denylist
- MOAD-0005 (Thundering Herd): no shared cache patterns in network code
2026-03-31 10:09:46 -04:00
8ea8ad434f
undf: assign 935-937; cataclysm-dda 3 CWE-407 defects
...
cataclysm-0001: overmap_ui search dedup vector O(P*M), 79x
cataclysm-0002: dependency_tree dedup vector O(N^2), 2x
cataclysm-0003: surroundings_menu item/terfurn dedup O(N^2), 9x
2026-03-31 10:08:23 -04:00
3c1ab5459c
undf: assign 941-943; stamp monogame patches
2026-03-31 10:07:59 -04:00
c2a1fc15cc
undf: assign 928-930; btcpayserver CWE-407 scan (3 defects)
...
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM
btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM
btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
2026-03-31 09:39:59 -04:00
995cd9af22
undf: assign 925-927; stamp cake_wallet patches
2026-03-31 09:16:17 -04:00
b62fd27e28
undf: assign 920-922; stamp wasabi patches
2026-03-31 09:13:59 -04:00
737891b5a1
undf: assign 917; stamp bcoin patch
2026-03-31 09:13:04 -04:00
36f9dd6a51
undf: assign 915-916; stamp wekan patches
2026-03-31 08:06:03 -04:00
3c3f9639cf
undf: assign 908-914; stamp transformers/ray-project/dask-project patches
2026-03-31 07:48:39 -04:00
0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
a4a1e444e6
undf: assign 741-880; stamp patches; generate_undf.py sync
2026-03-30 16:52:36 -04:00
494d1c82a3
undf: assign UNDF numbers, stamp patches; 878 total
2026-03-30 16:46:38 -04:00
8b5e3c35b1
undf: assign UNDF numbers, stamp patches; 875 total
2026-03-30 16:45:00 -04:00
7e717432dd
undf: assign UNDF-2026-000000874; stamp vllm-0001 patch
2026-03-30 16:42:12 -04:00
15db2a0269
synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN
...
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
2026-03-30 15:23:53 -04:00
dd20794faa
undf: assign 859-861; stamp patches; element-web-0003/element-web-0004/conduit-0001
2026-03-30 15:17:08 -04:00
2372d29c88
undf: assign UNDF-2026-000000858 for proxysql-0001; stamp patch
2026-03-30 14:59:38 -04:00
c31c569e45
undf: stamp gitlab-foss patches with UNDF numbers
2026-03-30 14:56:23 -04:00
4cc47349a5
undf: assign 847-849; stamp freecad/retroarch patches
2026-03-30 14:53:28 -04:00
