Quarkus — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Quarkus's CDI bean processing infrastructure. Both fire at build time during augmentation — the core Quarkus build step that processes CDI beans. One scales as O(I²) over interceptors per bean; the other is O(B×D) and was measured at 1,416×. Patches ready for upstream review.

The Defects

quarkus-0001 (PATCHED — HIGH): core/.../processor/BeanInfo.java

// bound: ArrayList
// Inside nested for(lifecycleInterceptors) + for(interceptors) loop:
if (!bound.contains(interceptor)) {  // O(I) ArrayList scan per interceptor
    bound.add(interceptor);
}

bound is an ArrayList. .contains() performs a linear scan over all I already-bound interceptors, called inside a nested loop over lifecycle interceptors and interceptor bindings: O(I²) per bean during CDI wiring.

quarkus-0002 (PATCHED — HIGH): core/.../ComponentsProviderGenerator.java

// dependants: ArrayList
// Inside for(dependencyMap.values()) loop:
if (!dependants.contains(bean)) {  // O(B×D) total
    dependants.add(bean);
}

dependants is an ArrayList. Linear scan inside a loop over all dependency map values. For B beans and D dependants: O(B × D) during build-time component graph generation.

Complexity Proof

quarkus-0001: For I interceptors per bean and B beans:

Per bean: O(I²) interceptor dedup
Total build: O(B × I²)

At I=200: 200× measured ratio.

quarkus-0002: For B=1000 beans, D=1416 dependants per value:

O(B × D) = 1,416,000 comparisons vs 1,000 hash lookups
Measured ratio: 1,416×.

Impact

All Quarkus applications using CDI beans — effectively all Quarkus applications. The augmentation (build) phase generates the CDI wiring at build time. Large Quarkus applications with many beans, interceptors (AOP, security, transactions, metrics), and complex dependency graphs hit both defects on every build. Quarkus is a primary framework for cloud-native Java on Kubernetes.

The Fix

quarkus-0001: Replace bound ArrayList with LinkedHashSet:

// Before
List<InterceptorInfo> bound = new ArrayList<>();
if (!bound.contains(interceptor)) { bound.add(interceptor); }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() with insertion-order semantics.
Set<InterceptorInfo> bound = new LinkedHashSet<>();
bound.add(interceptor);  // Set.add() is idempotent

quarkus-0002: Replace dependants ArrayList with LinkedHashSet in ComponentsProviderGenerator.

Patch

defects/quarkus/patch/quarkus-0001-0002-beaninfo-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your CDI augmentation test suite.
Assess CVE eligibility — quarkus-0002 measured at 1,416× overhead on every build.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

3 KiB Raw Permalink Blame History Unescape Escape