Jitsi Videobridge — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Three O(n²) defects in Jitsi Videobridge's bandwidth allocation and conference management. All fire in the real-time media path — during per-allocation-cycle source prioritization, selected sources tracking, and conference endpoint join/leave handling. Patches ready for upstream review.

The Defects

jvb-0001 (PATCHED — HIGH): Prioritize.kt:41,52

// Inside forEach(conferenceSources) — per allocation cycle:
if (prioritizedSources.contains(source)) { ... }   // O(N) List.contains()
val idx = prioritizedSources.indexOf(source)        // O(N) List.indexOf()

Both contains() and indexOf() perform O(N) list scans inside a forEach over conference sources. O(N²) per allocation cycle. Measured ratio: 33×.

jvb-0002 (PATCHED — HIGH): BandwidthAllocator.kt:222

// selectedSources getter — per allocation cycle:
if (sources.contains(source)) { ... }  // O(N) List.contains() per alloc

List.contains() called in selectedSources getter per allocation cycle. Measured ratio: 19×.

jvb-0003 (PATCHED — HIGH): ConferenceSpeechActivity.java:326

// Inside for(conferenceEndpoints) on join/leave:
if (dominantSpeakerList.contains(endpoint)) { ... }  // O(N) ArrayList scan

ArrayList.contains() inside endpoint iteration on every join/leave event. O(N²) total. Measured ratio: 35×.

Complexity Proof

jvb-0001: For N=33 conference sources per allocation cycle running at video bitrate scheduling frequency:

O(N²) = 1,089 comparisons per cycle
Fixed: LinkedHashSet → O(1) per check
33× measured ratio.

jvb-0002: 19× measured ratio at typical conference sizes.

jvb-0003: 35× measured ratio on join/leave with many endpoints.

Impact

All Jitsi Videobridge deployments — every video conference. Allocation cycles run continuously during conferences to manage bandwidth. Larger conferences (many participants, many video streams) maximize N. Jitsi Videobridge powers meet.jit.si and thousands of self-hosted Jitsi installations. These defects cause degraded bandwidth allocation quality under load, leading to poor video quality in large conferences.

The Fix

jvb-0001/0002: Replace List with LinkedHashSet for prioritizedSources/selectedSources:

// Before
val prioritizedSources: MutableList<MediaSourceDesc> = ArrayList()
if (prioritizedSources.contains(source)) { ... }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() with insertion-order iteration.
val prioritizedSources: MutableSet<MediaSourceDesc> = LinkedHashSet()
prioritizedSources.add(source)  // Set.add() is idempotent

jvb-0003: Replace ArrayList with LinkedHashSet for dominantSpeakerList.

Patch

defects/jvb/patch/jvb-0001-0002-0003-bandwidth-alloc-set.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your bandwidth allocation and conference test suites.
Assess CVE eligibility — all three defects fire continuously during active video conferences.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

3.3 KiB Raw Blame History Unescape Escape