First MOAD-0003 (Leaked Context) flagship this session. Surfaced via
scanner enhancement: commit 1f48798 (Java ThreadLocal-scoped .set fix)
dropped wildfly M3 noise from 4840 -> 37, exposing this real defect.
Defect: ElytronSecurityIntegration.java:38 declares
private final ThreadLocal<SecurityContext> securityContext = new ThreadLocal<>();
with setSecurityContext() calling .set(context) and ZERO corresponding
.remove() / .set(null) anywhere in the WildFly codebase (verified by
grep -rn). JCA WorkManager reuses pool threads across Work items from
different security principals; a leftover SecurityContext from prior
Work is visible to any subsequent Work that reads getSecurityContext()
before installing its own — which WildflyWorkWrapper.runWork() does
exactly to decide whether to use Elytron-runWork or super.runWork().
Fix: 2-file surgical patch (no SPI change):
1. setSecurityContext(null) now calls .remove() (clear ThreadLocal,
prevent classloader retention)
2. WildflyWorkWrapper.runWork() wraps body in try/finally that calls
setSecurityContext(null) after the Work item completes
This is the inverse pipeline from CWE-407 flagships: scanner improved
its signal-to-noise so triage could find what raw scanning could not
have ranked.
Three coupled defects in RTTIGccClassRecoverer:
1. isPossibleVttStart REBUILDS vtableAndVftableAddrs on every call (O(V) waste)
2. getVttAddresses calls it inside outer while loop (multiplies the rebuild)
3. addPointerToList uses List<Address>.contains for membership (O(V) per check)
Fix: hoist Set<Address> once, pass to isPossibleVttStart, eliminate per-call rebuild.
ghidra-0001 covers RecoveredClassHelper (MSVC + gcc) — the foundation pattern.
ghidra-0002 covers gcc-specific VTT recovery — extends coverage to Linux C++ binaries.
Together: ghidra C++ class recovery drops from seconds-to-minutes to milliseconds.
Flagship: weaviate authorization filter slices.Contains per item (O(N*K)).
Multi-tenant deployments with hundreds-thousands of permitted resources pay
this on every authorized read. Set hoist: 1735x speedup at N=50k K=5k.
Wave 11 honor roll: bash, coreutils. Cumulative: 49 projects.
The Gatsby authors annotated each of the three call sites in
in-memory/indexing.ts with 'expensive at scale' comments. Their
diagnosis is correct: nodeTypeNames.includes(node.internal.type)
inside iterateNodes().forEach is O(N*T) per cache build.
For N=100k+ nodes typical of mature content sites and T=10-30
declared types per query, this fires on every type-filtered query.
gatsby develop in particular rebuilds caches per page render.
Fix: hoist Set<string> once at the top of each function. O(1) per
node lookup. Total cost O(N+T). Bench shows 8.4x at N=100k T=50;
2.7-4.7x at smaller scales.
Three call sites patched: ensureIndexByElemMatch (line 326),
ensureEmptyFilterCache (378), ensureIndexByElemMatchValue (504).
Author 'expensive at scale' comments updated to record the fix.
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
