russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
1.6 KiB
Email Draft — CWE-407 Pre-Disclosure Outreach
To: [maintainer security contact — see README.md for sequencing] From: security@undefect.com Subject: Pre-disclosure: CWE-407 in [TOOL] — coordinated disclosure request Attachment: [tool].pdf (also in outreach.tar.gz · MD5: see MD5SUMS)
Hello [maintainer name],
We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in [TOOL]. We have a patch, a complexity proof, and a benchmark. We are requesting a 90-day coordinated disclosure window before any public release.
The short version:
A list is used where a set belongs, inside a [graph traversal / query planning / dependency resolution] loop. Membership is tested by linear scan. The result is O(n²) behavior in code that should run in O(n). The fix is a one-line data structure substitution with no behavioral change.
The attached brief covers:
- The exact file and line
- Before/after code
- Complexity proof (O-notation)
- Benchmark numbers
- The patch
What we ask:
- Confirm receipt within 5 business days.
- Validate the patch against your CI / regression suite.
- Coordinate a release date within the 90-day window.
- Credit optional — the goal is the fix, not the credit.
We are disclosing to all affected maintainers on a sequenced schedule. Your disclosure window starts from the date of this email.
Reply to this address or open a security advisory at your discretion.
— undefect. security@undefect.com https://undefect.com
Attachment integrity:
[PASTE MD5 FROM outreach/MD5SUMS for the specific PDF]
Verify with: md5sum [tool].pdf