russell@unturf.com
aeb084c9ae
Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2), cataclysm (3), cemu Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3), conduit, cura (2), curaengine, clamav, contiki
64 lines
2.8 KiB
Markdown
64 lines
2.8 KiB
Markdown
# ClickHouse Java Client — CWE-407 Disclosure Brief
|
||
**2026-04-13 · Patch available — awaiting upstream merge**
|
||
|
||
## Finding
|
||
|
||
One O(n²) defect in the ClickHouse Java client in the load-balancing node manager. `LinkedList.contains()` fires on every node health check and failover decision. Patched.
|
||
|
||
## The Defects
|
||
|
||
**clickhouse-java-0001 (PATCHED — MEDIUM):** `clickhouse-client/src/main/java/com/clickhouse/client/ClickHouseNodes.java:324`
|
||
|
||
```java
|
||
// In ClickHouseNodes — load balancing hot path:
|
||
protected final LinkedList<ClickHouseNode> nodes;
|
||
protected final LinkedList<ClickHouseNode> faultyNodes;
|
||
```
|
||
|
||
`nodes` and `faultyNodes` are `LinkedList<ClickHouseNode>`. The load-balancing logic calls `contains()` on both lists to check node health status and membership before routing queries. `LinkedList.contains()` is O(N) — a linear scan of the entire list.
|
||
|
||
In a cluster with N healthy nodes and F faulty nodes, every query routing decision costs O(N + F) for membership checks. During failover events when nodes move between healthy and faulty lists, `remove()` is also O(N).
|
||
|
||
## Complexity Proof
|
||
|
||
At N=50 healthy nodes, F=10 faulty nodes:
|
||
- Defective: 50 + 10 = 60 comparisons per query routing decision
|
||
- Fixed: 2 hash lookups (O(1) each)
|
||
- **30× op reduction per query.** At 10,000 queries/sec: 600,000 comparisons/sec eliminated.
|
||
|
||
## Impact
|
||
|
||
ClickHouse Java client serves production analytics workloads connecting to ClickHouse clusters. The load balancer routes every query through the node manager. High-throughput applications sending thousands of queries per second pay the linear scan cost on every single query. During cluster instability when nodes flap between healthy and faulty states, the cost compounds further.
|
||
|
||
## The Fix
|
||
|
||
Replace `LinkedList` with `LinkedHashSet` for O(1) `contains()` while preserving insertion order:
|
||
|
||
```java
|
||
// Before
|
||
protected final LinkedList<ClickHouseNode> nodes;
|
||
protected final LinkedList<ClickHouseNode> faultyNodes;
|
||
|
||
// After — O(1) contains, preserves iteration order
|
||
protected final LinkedHashSet<ClickHouseNode> nodes;
|
||
protected final LinkedHashSet<ClickHouseNode> faultyNodes;
|
||
```
|
||
|
||
## Patch
|
||
|
||
Fix available: `defects/clickhouse-java/patch/clickhouse-java-0001-load-balancing-faulty-nodes-linked-list.patch`
|
||
|
||
Single-file patch in `ClickHouseNodes.java`.
|
||
|
||
Unit test: pass. **30× op reduction at 50 nodes.**
|
||
|
||
## What We Ask
|
||
|
||
A patch is ready for review.
|
||
|
||
1. Confirm receipt and assign a GitHub issue reference (ClickHouse/clickhouse-java).
|
||
2. Assess severity — fires on every query routing decision in clustered deployments.
|
||
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
|
||
4. We will credit the ClickHouse team in the public disclosure. Preferred acknowledgment format welcome.
|
||
|
||
Contact: see cover email. This brief is confidential until coordinated disclosure.
|