# Apache Camel — CWE-407 Scan Result: CLEAN (beyond camel-0001)

## Scan Date: 2026-03-29

## Scope
Searched for route dependency traversal, `@DependsOn`-style annotation handling, and
recursive route startup ordering without visited sets. The pre-existing `camel-0001` defect
(route startup `ArrayList` O(R²)) is already documented.

## Findings

### InternalRouteStartupManager
Route startup ordering uses `TreeMap` and `LinkedHashMap` for ordering — no recursive
traversal of a route dependency graph. Routes are sorted by `startupOrder` integer value
via `Comparator`, not by graph traversal.

### AbstractCamelContextFactoryBean.getDependsOn
`getDependsOn()` is an abstract method returning a `String` — just a label for Spring
`@DependsOn` ordering. No Camel-internal graph traversal is performed; Spring's own
dependency resolution handles this.

### Route dependency shutdown (DefaultShutdownStrategy)
Uses reverse `startupOrder` sorting — no recursive graph traversal.

### TypeUtils / annotation processors
Camel does not use annotation processors for meta-annotation hierarchies in the manner
Dubbo does. Camel's `@RoutingSlip`, `@RecipientList` etc. are resolved at runtime on
flat lists.

## Conclusion
CLEAN (beyond pre-existing camel-0001). No additional CWE-407 defects found in Apache Camel
route dependency or startup ordering code.