russell@unturf.com aeb084c9ae feat: add 30 outreach docs (batches 9-10)

Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2),
  cataclysm (3), cemu
Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3),
  conduit, cura (2), curaengine, clamav, contiki

2026-04-14 19:51:36 -04:00

2.8 KiB

Raw Permalink Blame History

ClickHouse Java Client — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in the ClickHouse Java client in the load-balancing node manager. LinkedList.contains() fires on every node health check and failover decision. Patched.

The Defects

clickhouse-java-0001 (PATCHED — MEDIUM): clickhouse-client/src/main/java/com/clickhouse/client/ClickHouseNodes.java:324

// In ClickHouseNodes — load balancing hot path:
protected final LinkedList<ClickHouseNode> nodes;
protected final LinkedList<ClickHouseNode> faultyNodes;

nodes and faultyNodes are LinkedList<ClickHouseNode>. The load-balancing logic calls contains() on both lists to check node health status and membership before routing queries. LinkedList.contains() is O(N) — a linear scan of the entire list.

In a cluster with N healthy nodes and F faulty nodes, every query routing decision costs O(N + F) for membership checks. During failover events when nodes move between healthy and faulty lists, remove() is also O(N).

Complexity Proof

At N=50 healthy nodes, F=10 faulty nodes:

Defective: 50 + 10 = 60 comparisons per query routing decision
Fixed: 2 hash lookups (O(1) each)
30× op reduction per query. At 10,000 queries/sec: 600,000 comparisons/sec eliminated.

Impact

ClickHouse Java client serves production analytics workloads connecting to ClickHouse clusters. The load balancer routes every query through the node manager. High-throughput applications sending thousands of queries per second pay the linear scan cost on every single query. During cluster instability when nodes flap between healthy and faulty states, the cost compounds further.

The Fix

Replace LinkedList with LinkedHashSet for O(1) contains() while preserving insertion order:

// Before
protected final LinkedList<ClickHouseNode> nodes;
protected final LinkedList<ClickHouseNode> faultyNodes;

// After — O(1) contains, preserves iteration order
protected final LinkedHashSet<ClickHouseNode> nodes;
protected final LinkedHashSet<ClickHouseNode> faultyNodes;

Patch

Fix available: defects/clickhouse-java/patch/clickhouse-java-0001-load-balancing-faulty-nodes-linked-list.patch

Single-file patch in ClickHouseNodes.java.

Unit test: pass. 30× op reduction at 50 nodes.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (ClickHouse/clickhouse-java).
Assess severity — fires on every query routing decision in clustered deployments.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the ClickHouse team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Permalink Blame History Unescape Escape