engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/whitepaper/outreach/README.md

193 lines
8 KiB
Markdown
Raw Permalink Blame History

# CWE-407 Outreach Briefs
**2026-03-27 · Confidential pre-disclosure**
One focused brief per participant. Each document is standalone — the recipient sees only
their own findings, not the full cross-ecosystem map.
**157 sites patched. 66 outreach briefs. 52 ecosystems.**
---
## Files
| File | Purpose |
|------|---------|
| [send-queue.md](send-queue.md) | Full email bodies for maintainer pre-disclosure |
| [contacts.md](contacts.md) | Cold outreach contacts — press, CVE bodies, researchers, community |
| [email-draft.md](email-draft.md) | Generic email template |
---
## Participants
### Compilers and Language Runtimes
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [javac.md](javac.md) | OpenJDK / Oracle / Amazon Corretto | 5 | All patched | HIGH |
| [typescript.md](typescript.md) | Microsoft TypeScript | 3 | All patched | HIGH |
| [ghc.md](ghc.md) | Haskell Foundation / GHC | 4 | All patched | HIGH |
| [scala3.md](scala3.md) | Scala Center / EPFL | 1 | Patched | **CRITICAL (O(n³))** |
| [rustc.md](rustc.md) | Rust / rust-lang.org | 2 | Both patched | HIGH/MEDIUM |
| [kotlin.md](kotlin.md) | JetBrains / Kotlin | 1 | Patched | HIGH |
| [gcc.md](gcc.md) | GCC Project / FSF | 1 | Patched | MEDIUM |
| [llvm.md](llvm.md) | LLVM / Apple / Google | 3 | All patched | HIGH |
| [v8.md](v8.md) | Google V8 / Chrome | 1 | Patched | HIGH |
| [spidermonkey.md](spidermonkey.md) | Mozilla SpiderMonkey / Firefox | 1 | Patched | HIGH |
### Build Tools and Package Managers
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [build-tools.md](build-tools.md) | Maven, CMake, npm, pip, Composer | 8 | All patched | MEDIUM |
| [bazel.md](bazel.md) | Google Bazel | 2 | Both patched | HIGH |
| [jenkins.md](jenkins.md) | CloudBees / Jenkins | 2 | Both patched | MEDIUM |
| [buildkit.md](buildkit.md) | Docker / Moby | 1 | Patched | MEDIUM |
| [luigi.md](luigi.md) | Spotify / Luigi | 1 | Patched | MEDIUM |
### Language Runtimes and Scripting
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [erlang-otp.md](erlang-otp.md) | Ericsson / erlang.org | 2 | 1 patched, 1 fixable-upstream | HIGH |
| [swipl.md](swipl.md) | SWI-Prolog | 3 | 2 patched, 1 fixable-pending | HIGH |
### Web Frameworks
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [django.md](django.md) | Django Software Foundation | 4 | All patched | HIGH/MEDIUM |
| [rails.md](rails.md) | Rails Core / 37signals | 11 | All patched | HIGH/MEDIUM |
| [pyramid.md](pyramid.md) | Pylons Project | 5 | All patched | MEDIUM |
| [bottle.md](bottle.md) | bottle.py | 1 | Patched | MEDIUM |
### ORM / Database Frameworks
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [hibernate.md](hibernate.md) | Red Hat / Hibernate | 5 | All patched | HIGH |
| [mybatis.md](mybatis.md) | MyBatis / Apache | 1 | Patched | MEDIUM |
| [efcore.md](efcore.md) | Microsoft / EF Core | 3 | All patched | HIGH |
| [sqlalchemy.md](sqlalchemy.md) | SQLAlchemy | 2 | Both patched | MEDIUM |
| [peewee.md](peewee.md) | coleifer / Peewee | 1 | Patched | MEDIUM |
| [sequelize.md](sequelize.md) | Sequelize | 2 | Both patched | MEDIUM |
| [typeorm.md](typeorm.md) | TypeORM | 3 | All patched | HIGH |
| [doctrine.md](doctrine.md) | Doctrine Project / Symfony | 3 | All patched | HIGH |
| [seaorm.md](seaorm.md) | SeaQL / SeaORM | 4 | All patched | HIGH |
| [diesel.md](diesel.md) | Diesel ORM / Rust | 3 | All patched | MEDIUM |
| [gorm.md](gorm.md) | GORM / go-gorm | 1 | Patched | MEDIUM |
| [exposed.md](exposed.md) | JetBrains / Exposed | 3 | All patched | HIGH |
### Databases
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [postgresql.md](postgresql.md) | PostgreSQL Core Team | 5 | 3 patched, 2 deferred | HIGH |
| [mongodb.md](mongodb.md) | MongoDB Inc. | 7 | 4 patched, 1 deferred, 2 NWF | HIGH |
### Game Engines and Graphics
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [godot.md](godot.md) | Godot Engine | 4 | All patched | HIGH |
| [pygame.md](pygame.md) | pygame / Python | 4 | All patched | HIGH |
| [sfml.md](sfml.md) | SFML | 5 | All patched | HIGH |
| [threejs.md](threejs.md) | Three.js / mrdoob | 5 | All patched | HIGH |
| [angelscript.md](angelscript.md) | AngelScript | 3 | All patched | HIGH |
| [dry.md](dry.md) | Dry (Urho3D fork) | 2 | Both patched | HIGH |
| [tinkerpop.md](tinkerpop.md) | Apache TinkerPop / Gremlin | 1 | Patched | **CRITICAL (O(n²) per traverser)** |
### Blockchain / Smart Contracts
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [solidity.md](solidity.md) | Ethereum Foundation | 2 | Both patched | HIGH/MEDIUM |
### Network Routing / SDN
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [frrouting.md](frrouting.md) | FRRouting / LFN | 2 | Both patched | HIGH |
| [bird.md](bird.md) | CZ.NIC / BIRD | 2 | Both patched | HIGH |
| [onos.md](onos.md) | ON.Lab / ONOS | 1 | Patched | HIGH |
| [httpd.md](httpd.md) | Apache httpd | 1 | Patched | MEDIUM |
### Infrastructure / DevOps / Automation
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [terraform.md](terraform.md) | HashiCorp / Terraform | 2 | Both patched | HIGH |
| [ansible.md](ansible.md) | Red Hat / Ansible | 2 | Both patched | HIGH |
| [saltstack.md](saltstack.md) | VMware / SaltStack | 1 | Patched | MEDIUM |
| [cfengine.md](cfengine.md) | Northern.tech / CFEngine | 3 | All patched | HIGH |
| [puppet.md](puppet.md) | Puppet / Perforce | 1 | Patched | MEDIUM |
### Code Quality Tools (Ruby)
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [rubocop.md](rubocop.md) | RuboCop / Ruby | 2 | Both patched | MEDIUM |
| [solargraph.md](solargraph.md) | Solargraph / Ruby LSP | 2 | Both patched | MEDIUM |
### Graph / Data Science
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [networkx.md](networkx.md) | NetworkX / Python | 1 | Patched | MEDIUM |
### Messaging / Scientific / Other
| File | Org | Sites | Status | Severity |
|------|-----|-------|--------|----------|
| [rabbitmq.md](rabbitmq.md) | VMware / RabbitMQ | 1 | Patched | HIGH |
| [kicad.md](kicad.md) | KiCad EDA | 1 | Patched | HIGH |
| [octave.md](octave.md) | GNU Octave | 1 | Patched | MEDIUM |
| [tor.md](tor.md) | Tor Project | 1 | Patched | MEDIUM |
| [minecraft.md](minecraft.md) | Mojang / Microsoft | 2 + 1 mod | Unpatched | **EXPONENTIAL** |
---
## Sequencing
**Wave 1 — Build tools, low blast radius:**
build-tools.md → erlang-otp.md → swipl.md → tor.md
**Wave 2 — Compilers (coordinated, same window):**
javac.md, typescript.md, ghc.md, scala3.md, rustc.md, kotlin.md, llvm.md, gcc.md
**Wave 3 — Infrastructure and databases:**
postgresql.md, mongodb.md, frrouting.md, bird.md, onos.md, terraform.md
**Wave 4 — Web frameworks and ORMs:**
django.md, rails.md, hibernate.md, efcore.md, typeorm.md, sqlalchemy.md
**Wave 5 — Remaining ORMs and frameworks:**
doctrine.md, seaorm.md, diesel.md, sequelize.md, gorm.md, exposed.md, peewee.md, mybatis.md,
pyramid.md, bottle.md, rubocop.md, solargraph.md
**Wave 6 — Game engines and graphics:**
godot.md, pygame.md, sfml.md, threejs.md, angelscript.md, dry.md, tinkerpop.md
**Wave 7 — DevOps and CI:**
ansible.md, saltstack.md, cfengine.md, puppet.md, jenkins.md, bazel.md, buildkit.md, luigi.md
**Wave 8 — Runtimes, browsers, other:**
v8.md, spidermonkey.md, rabbitmq.md, kicad.md, networkx.md, octave.md, httpd.md
**Wave 9 — High-visibility / public-facing:**
solidity.md, minecraft.md
---
## Contact template
**Subject:** Pre-disclosure: CWE-407 in [tool] — coordinated disclosure request
We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in
[tool]. We have a patch, complexity proof, and benchmark. We are requesting a 90-day
coordinated disclosure window before public release.
Details and patch attached.
Contact: security@undefect.com
Reference in a new issue View git blame Copy permalink