63 lines
2.5 KiB
Markdown
63 lines
2.5 KiB
Markdown
# Apache Tomcat — CWE-407 Disclosure Brief
|
||
**2026-03-27 · Patch available — awaiting upstream merge**
|
||
|
||
## Finding
|
||
|
||
One O(n²) defect in Apache Tomcat's clustering replication valve. The `crossContextSessions` collection is an `ArrayList`, causing O(n²) session lookup overhead on every clustered request that touches cross-context sessions. Patch ready for upstream review.
|
||
|
||
## The Defects
|
||
|
||
**tomcat-0001 (PATCHED — HIGH):** `java/org/apache/catalina/ha/tcp/ReplicationValve.java:265`
|
||
|
||
```java
|
||
// crossContextSessions: ArrayList
|
||
// Per clustered request:
|
||
if (crossContextSessions.contains(session)) { // O(n) ArrayList scan
|
||
...
|
||
}
|
||
```
|
||
|
||
`crossContextSessions` is an `ArrayList`. `.contains()` performs a linear scan over all N sessions in the list for every membership check. Called on every clustered HTTP request that uses cross-context session replication: **O(n²) total** when sessions accumulate.
|
||
|
||
## Complexity Proof
|
||
|
||
For N cross-context sessions:
|
||
- Per request: O(N) `contains()` scan
|
||
- Over R requests with S sessions: **O(R × N)**
|
||
- Accumulated across replication events: **O(N²)**
|
||
|
||
Fix: replace `ArrayList` with `LinkedHashSet` for O(1) `contains()`.
|
||
|
||
## Impact
|
||
|
||
All Apache Tomcat deployments using session replication in a cluster with cross-context sessions. This includes enterprise Java EE applications on Tomcat clusters, applications using `<Manager className="org.apache.catalina.ha.session.DeltaManager">`, and any multi-context web application sharing sessions across contexts. Tomcat is one of the most widely deployed Java application servers globally.
|
||
|
||
## The Fix
|
||
|
||
Replace `ArrayList` with `LinkedHashSet`:
|
||
|
||
```java
|
||
// Before
|
||
private ArrayList<Session> crossContextSessions = new ArrayList<>();
|
||
if (crossContextSessions.contains(session)) { ... }
|
||
|
||
// After
|
||
// CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(n) ArrayList scan.
|
||
private LinkedHashSet<Session> crossContextSessions = new LinkedHashSet<>();
|
||
if (crossContextSessions.contains(session)) { ... }
|
||
```
|
||
|
||
`LinkedHashSet` preserves insertion order and provides O(1) `contains()`.
|
||
|
||
## Patch
|
||
|
||
`defects/tomcat/patch/tomcat-0001-replicationvalve-linkedhashset.patch`
|
||
|
||
## What We Ask
|
||
|
||
1. Confirm receipt and assign a Bugzilla or GitHub Security Advisory reference.
|
||
2. Validate the patch against your clustering and session replication test suite.
|
||
3. Assess CVE eligibility — fires on every clustered request with cross-context sessions.
|
||
4. Coordinate a disclosure date — we are targeting 90 days from first contact.
|
||
|
||
Contact: see cover email. This brief is confidential until coordinated disclosure.
|