Apache Tomcat — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Apache Tomcat's clustering replication valve. The crossContextSessions collection is an ArrayList, causing O(n²) session lookup overhead on every clustered request that touches cross-context sessions. Patch ready for upstream review.

The Defects

tomcat-0001 (PATCHED — HIGH): java/org/apache/catalina/ha/tcp/ReplicationValve.java:265

// crossContextSessions: ArrayList
// Per clustered request:
if (crossContextSessions.contains(session)) {  // O(n) ArrayList scan
    ...
}

crossContextSessions is an ArrayList. .contains() performs a linear scan over all N sessions in the list for every membership check. Called on every clustered HTTP request that uses cross-context session replication: O(n²) total when sessions accumulate.

Complexity Proof

For N cross-context sessions:

Per request: O(N) contains() scan
Over R requests with S sessions: O(R × N)
Accumulated across replication events: O(N²)

Fix: replace ArrayList with LinkedHashSet for O(1) contains().

Impact

All Apache Tomcat deployments using session replication in a cluster with cross-context sessions. This includes enterprise Java EE applications on Tomcat clusters, applications using <Manager className="org.apache.catalina.ha.session.DeltaManager">, and any multi-context web application sharing sessions across contexts. Tomcat is one of the most widely deployed Java application servers globally.

The Fix

Replace ArrayList with LinkedHashSet:

// Before
private ArrayList<Session> crossContextSessions = new ArrayList<>();
if (crossContextSessions.contains(session)) { ... }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(n) ArrayList scan.
private LinkedHashSet<Session> crossContextSessions = new LinkedHashSet<>();
if (crossContextSessions.contains(session)) { ... }

LinkedHashSet preserves insertion order and provides O(1) contains().

Patch

defects/tomcat/patch/tomcat-0001-replicationvalve-linkedhashset.patch

What We Ask

Confirm receipt and assign a Bugzilla or GitHub Security Advisory reference.
Validate the patch against your clustering and session replication test suite.
Assess CVE eligibility — fires on every clustered request with cross-context sessions.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape