java-topology/docs/tickets
russell@unturf.com 2eea7d128c
4 follow-up patches shipped: wildfly-0002 + wildfly-0003 + log4j2-0001 + nakama-0001
Acting on the 4 borderline candidates flagged in the session-summary intel.
All 4 surfaced after the unmoad scanner enhancements cleared M3/M4 noise.

UNDF-1306 wildfly-0002 (HIGH) - ElytronSecurityDomainContextImpl.isValid()
  sets currentIdentity ThreadLocal with no paired cleanup contract. Subject
  populated at line 69 is the canonical handover; the ThreadLocal stash leaks
  to next request on the pool thread. Fix: drop the .set(identity) line.

UNDF-1307 wildfly-0003 (LOW) - TransactionRollbackSetupAction.depth.set(null)
  should be depth.remove() to fully delete the ThreadLocal entry; current
  pattern leaves null binding pinning the WildFly classloader during
  undeploy/redeploy. Functional clear, classloader-retention only.

UNDF-1308 log4j2-0001 (HIGH) - Log4jMDCAdapter.clear() only clears the
  log4j ThreadContext map, NOT the SLF4J pushByKey/popByKey stacks
  (mapOfStacks ThreadLocal). SLF4J spec mandates clear() means "clear
  all MDC". Per-key Deques accumulate across requests. Fix: add clear()
  to ThreadLocalMapOfStacks (calls tlMapOfStacks.remove()) and call from
  the public clear().

UNDF-1309 nakama-0001 (HIGH MOAD-0004) - social/social.go logs OAuth
  access tokens, ID tokens, oauth2.Token objects (incl. refresh tokens),
  Steam publisherKey + ticket at debug level via zap.String/zap.Any.
  11 call sites. Fix: replace value-logging with shape-logging (token_len,
  has_token bool) — preserves debug value, redacts secret bytes.

First MOAD-0004 patch this session. Companion to the 3 MOAD-0003 patches
(wildfly-0001/0002/0003) extending the inverse-pipeline pattern across
projects: scanner enhancement -> noise reduction -> human triage finds
defects that were buried.

Total session flagships: 9 (was 6) — 5 CWE-407 + 3 MOAD-0003 + 1 MOAD-0004.
2026-04-26 12:30:28 -04:00
..
diagrams undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
0001-tarjan-ov2-stack-contains.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
0002-inference-graph-findnode-linear-scan.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
0003-module-hasher-topo-deque-contains.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
0004-dependencies-node-list-contains.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
0005-inference-context-isequiv-containsall.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
activemq-0001-topic-consumers-copyonwrite-contains-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
allegro5-0001-al-play-sample-linear-slot-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
asterisk-0001-meetme-conf-find-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
asterisk-0002-confbridge-active-list-user-find-linear.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
bevy-0001-slab-allocator-free-empty-slabs-vec-position.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
box2d-0001-broad-phase-unbuffer-move-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
bullet-0001-ghostobject-overlapping-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
bullet-0002-collisionobject-checkcollide-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
bullet-0003-sortedpairscache-findpair-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
caddy-0001-host-by-hashing-full-pool-scan-per-request.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
cassandra-0001-dead-states-list-contains-per-gossip-round.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
check-0001-suite-tcase_by_name-linear-strcmp.md test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches) 2026-04-23 08:54:44 -04:00
cilium-0001-requirement-hasvalue-linear-scan-identity-matching.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
clickhouse-0001-replace-column-transformer-names-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
cockroachdb-0001-indexes-used-slice-contains-per-add.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
cpython-0001-pkgutil-path-list-contains-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
curl-0001-cookie-replace-existing-llist-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
dendrite-0001-syncapi-prev-events-double-loop.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
dendrite-0002-backfill-bwextrems-double-loop.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
doctrine-orm-0001-hydrator-discriminator-in-array.md ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems) 2026-03-27 13:34:26 -04:00
doctrine-orm-0002-classmetadata-addsubclass-linear-dedup.md ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems) 2026-03-27 13:34:26 -04:00
doctrine-orm-0003-sqlwalker-partial-field-in-array.md ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems) 2026-03-27 13:34:26 -04:00
dovecot-0001-dsync-keyword-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
dragonflybsd-0001.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
dragonflybsd-0002.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
dragonflybsd-0003.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
dragonflybsd-0004.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
dragonflybsd-0005.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
duckdb-0001-correlated-columns-vector-linear-dedup.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
ejabberd-0001-mam-archive-prefs-list-member-per-message.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
ejabberd-0002-shared-roster-is-user-in-group-list-member.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
element-web-0001-textforevent-users-indexof-quadratic-dedup.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
envoy-0001-previous-hosts-retry-predicate-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
exposed-0001-mapMissingColumnStatements-O2-list-scan.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
exposed-0002-isAKeyword-O-N-list-scan.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
exposed-0003-Table-clone-consParamNames-O2.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
express-0001-clean.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
fastapi-0001-get-flat-dependant-visited-list.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
ffmpeg-0001-codec-tag-linear-scan-per-stream.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
fiber-0001-custom-binder-mime-slice-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
flink-0001-jobgraph-userjar-list-contains-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
freeswitch-0001-conference-relationship-scan-per-sample.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
gatsby-0001-indexing-nodetypenames-includes-set.md wave6 follow-up: gatsby-0001 — three filter-cache builders nodeTypeNames.includes -> Set 2026-04-25 10:15:32 -04:00
ghidra-0001-recoveredclasshelper-list-to-set.md wave20: ghidra-0001 UNDF-1303 (6.5x-27x RecoveredClassHelper) + 9 clean-scan additions 2026-04-25 15:49:17 -04:00
ghidra-0002-getvttaddresses-set-hoist.md ghidra-0002 UNDF-1304: 28x-768x getVttAddresses set hoist (companion to ghidra-0001) 2026-04-25 17:49:23 -04:00
ghost-0001-referrers-history-source-date-map.md wave16: ghost-0001 UNDF-1302 (15x-184x ReferrersStats) + 6 clean-scan additions 2026-04-25 15:01:06 -04:00
gin-0001-method-trees-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
go-0001-isparameterized-tparams-slices-index-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
gorm-0001-sortcallbacks-getindex-quadratic.md ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems) 2026-03-27 13:34:26 -04:00
gradle-0001-option-reader-tolist-contains-per-method.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
grafana-0001-dfs-visited-array-includes-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
gstreamer-0001-element-factory-list-filter-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
haproxy-0001-pat-match-bin-list-walk-below-lru-threshold.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
helm-0001-process-dependency-enabled-quadratic-lookup.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
hurd-0001.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
hurd-0002.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
hurd-0003.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
hurd-0004.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
hurd-0005.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
hurd-0006.md hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch 2026-04-05 15:57:48 -04:00
istio-0001-virtualhost-domains-linear-scan-rc-patch.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
jami-daemon-0001-conversation-load-replies-vector-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
jami-daemon-0002-conversation-module-std-find-on-set-members.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
jasmine-0001-spyregistry-spyonallfunctions-indexof.md test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches) 2026-04-23 08:54:44 -04:00
jetty-0001-httpfields-quotedcsv-getvalues-list-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
jitsi-videobridge-0001-prioritize-source-list-contains.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
jitsi-videobridge-0002-bandwidth-allocator-selected-sources-contains.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
jitsi-videobridge-0003-conference-speech-activity-arraylist-contains.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
julia-0001-isrelocatable-includes-vector-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
knex-0001-migrator-completed-name-set.md wave6: knex-0001 flagship + 38-target docgen/webfw/migration scan survey 2026-04-25 10:10:12 -04:00
koa-0001-clean.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
kotlin-0002-typeboundsimpl-arraylist-contains-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
ktor-0001-clean.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
kubernetes-0001-job-exit-code-policy-slices-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
kubernetes-0002-gc-owner-ref-uid-slices-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
lean4-0001-lake-guardcycle-callstack-list-quadratic.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0002-kernel-inductive-std-find-nested-loop.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0003-library-util-fresh-name-std-find-while.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0004-irinterpreter-double-checked-locking-race.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0005-lake-job-registration-concurrent-race.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0006-kernel-trace-thread-local-options-leak.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
lean4-0007-runtime-process-windows-env-var-quadratic.md scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003) 2026-04-13 08:34:02 -04:00
libgdx-0001-model-loadnode-nested-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
libgdx-0002-modelbuilder-rebuildreferences-array-contains.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
libgdx-0003-modelinstance-invalidate-array-contains.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
libgdx-0004-kerning-gpos-intarray-contains.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
linkerd2-0001-federated-service-remote-discovery-quadratic-dedup.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
linphone-0001-offeranswer-match-payloads-quadratic.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
linux-0001-headerdep-hash.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0002-audit-filter-inodes-quadratic.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0003-dev-alloc-name-nested-altname-scan.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0004-neigh-parms-ifindex-linear-scan.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0005-component-find-quadratic.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0006-btf-module-scan-hash.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0007-pktgen-thread-dev-xarray.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
linux-0008-taskstats-listener-hashset.md linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008 2026-04-04 11:41:36 -04:00
log4j2-0001-mdcadapter-clear-leaks-stacks.md 4 follow-up patches shipped: wildfly-0002 + wildfly-0003 + log4j2-0001 + nakama-0001 2026-04-26 12:30:28 -04:00
love2d-0001-getjoystickfromid-linear-scan-per-event.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
lua-0001-searchupvalue-linear-scan-per-reference.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mariadb-0001-setup-order-group-find-item-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mariadb-0002-setup-new-fields-find-item-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mattermost-0001-check-roles-exist-nested-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
maven-0001-lifecycle-standard-list-of-contains-per-mojo.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
memcached-0001-slabs-clsid-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mongodb-0001-relevant-tag-first-notfirst-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mysql-0001-show-grants-using-roles-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
mysql-0002-has-global-grant-fallback-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
nakama-0001-social-oauth-token-debug-log-leak.md 4 follow-up patches shipped: wildfly-0002 + wildfly-0003 + log4j2-0001 + nakama-0001 2026-04-26 12:30:28 -04:00
nats-0001-jetstream-cluster-peer-dedup-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
nestjs-0001-scanner-ctxregistry-array-includes.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
nestjs-0002-get-injection-providers-array-includes.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
netbsd-0001.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
netbsd-0002.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
netbsd-0003.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
netbsd-0004.md undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407) 2026-04-05 19:46:54 -04:00
nginx-0001-upstream-cache-get-linear-name-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
odl-0002-shardmanager-snapshot-shardlist-linear.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
ogre-0001-node-destructor-queuedupdates-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
ogre-0002-resourcegroupmanager-notifyresourcesremoved-nested-find.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
ogre-0003-ribbontrail-clearchain-index-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
onos-0002-pipeline-hitchain-arraylist-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
onos-0003-roleinfo-backups-immutablelist-linear.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
opensmtpd-0001-ruleset-tailq-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
openssl-0001-ssl-get-shared-ciphers-quadratic-find.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
openssl-0002-ciphersuite-cb-quadratic-dedup.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
openvpn-0001-ncp-get-best-cipher-quadratic-membership.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
otel-collector-0001-pcommon-map-put-linear-scan-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
ovs-0001-dpif-offload-port-add-linear-provider-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
panda3d-0001-camera-display-regions-linear-find.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
panda3d-0002-graphics-output-total-display-regions-linear-find.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
perl5-0001-pad-findlex-linear-scan-per-lexical-lookup.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
phoenix-0001-channel-dispatch-event-intercepts-list-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
phoenix-0002-router-scope-pipe-through-list-membership.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
php-0001-named-arg-linear-scan-compile-time.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
php-0002-named-arg-linear-scan-runtime.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
pip-0001-cache-support-index-min-linear-tag-scan-per-wheel.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
playwright-0001-roleutils-validroles-array-includes.md browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio) 2026-04-22 18:14:39 -04:00
postfix-0001-resolve-domain-list-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
postfix-0002-masquerade-exception-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
prometheus-0001-builder-labels-del-slice-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
prosody-0001-clean.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
psalm-0001-filefilter-allowsclass-in-array.md wave4: psalm-0001 flagship patch + linter/CI/config scan survey 2026-04-24 17:21:51 -04:00
pylons-0001-toposorter-names-list-membership.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
pylons-0002-toposorter-sorted-names-list-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
pylons-0003-toposorter-order-list-remove.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
pyroscope-0001-getblockstats-ulids-set.md wave13: pyroscope-0001 UNDF-1301 (47x-438x GetBlockStats) + 5 clean-scan additions 2026-04-25 14:30:18 -04:00
r-source-0001-rapply-class-match-nested-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
rabbitmq-0003-check-declare-arguments-quadratic-validator-filter.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
rabbitmq-0004-check-arguments-key-quadratic-invalid-args-member.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
rails-0001-preloader-batch-future-tables.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0002-callbacks-chain-index.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0003-enumerable-excluding-set.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0004-enumerable-in-order-of-series-index.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0005-schema-dumper-constraint-names-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0006-postgresql-schema-include-columns-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0007-lazy-load-hooks-run-once-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0008-enum-value-method-names-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0009-filter-attribute-handler-filter-params-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0010-encryption-auto-filtered-params-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
rails-0011-time-zone-conversion-skip-list-array.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
raylib-0001-getglyphindex-linear-scan-per-char-draw.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
README.md undefect. CWE-407 — 92 sites, 42 ecosystems 2026-03-26 19:48:18 -04:00
redis-0001-sinter-listpack-quadratic-membership.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
redis-0002-acl-upcoming-channel-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
redot-cwe407-12-defects.md redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242 2026-04-03 21:00:29 -04:00
rocketchat-0001-send-notifications-mention-ids-array-scan-per-subscriber.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
rocketchat-0002-notify-users-user-ids-array-scan-per-subscription.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
ruby-0001-kwarg-setup-linear-scan-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
scala-0001-checkable-baseclasses-nested-linear-scan.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
sdl2-0001-getjoystickfromid-linked-list-walk.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
sdl3-0001-gamepad-mapping-change-tracking-linear-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
seaorm-0001-establish-links-leftover-quadratic.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
seaorm-0002-rbac-group-permissions-linear-find.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
seaorm-0003-sorted-tables-vec-contains.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
seaorm-0004-topological-sort-from-iter-seen-vec.md ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems) 2026-03-27 13:49:46 -04:00
selenium-0001-grid-session-mutator-list-contains.md browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio) 2026-04-22 18:14:39 -04:00
selenium-0002-chromiumoptions-merge-args-extensions-list-contains.md browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio) 2026-04-22 18:14:39 -04:00
signal-server-0001-clean.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
simplex-chat-0001-members-role-elem-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
simplex-chat-0002-block-members-elem-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
simplex-chat-0003-introduce-remaining-notelem-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
sinatra-0001-content-type-add-charset-array-scan.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
sinatra-0002-provides-types-array-include-per-request.md game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
spring-0003-eventmulticaster-alllisteners-arraylist-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
spring-0004-defaultlistenerretriever-alllisteners-arraylist-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
storm-0001-fields-constructor-list-contains-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
storm-0002-workerstate-localtaskids-arraylist-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
synapse-0001-server-notices-referenced-events-list-remove.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
synapse-0002-sync-get-users-in-room-sequence-linear-scan.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
testcafe-0001-selector-filter-expand-indexof.md browser-automation wave 2: testcafe-0001 + webdriverio-0002 2026-04-22 18:31:53 -04:00
testng-0001-dynamicgraph-todot-freenodes-contains.md test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches) 2026-04-23 08:54:44 -04:00
tidb-0001-merge-join-offsets-slice-contains-per-key.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
tidb-0002-predicate-simplification-remove-values-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
tomcat-0001-replicationvalve-crosscontext-arraylist-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
tor-0002-nodelist-family-id-quadratic-smartlist-contains.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
tor-0003-scheduler-kist-smartlist-contains-pending.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
unrealircd-0001-has-common-channels-quadratic-membership.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
unrealircd-0002-sjoin-find-membership-link-quadratic.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
vagrant-0001-bundler-plugin-include-in-loop.md wave5: vagrant-0001 flagship + 32-target CI/CD/IaC scan survey 2026-04-25 10:01:56 -04:00
valkey-0001-sinter-listpack-quadratic-membership.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
valkey-0002-acl-upcoming-channel-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
varnish-0001-ban-check-object-linear-ban-list-walk.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
vitest-0001-coverage-v8-result-find.md test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches) 2026-04-23 08:54:44 -04:00
vlc-0001-module-find-linear-scan-per-check.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
weaviate-0001-rbac-filter-allowedlist-set.md wave11: weaviate-0001 UNDF-1300 (87x-1735x RBAC filter) + 2 clean-scan additions 2026-04-25 14:10:05 -04:00
webdriverio-0001-xpath-conditions-ormatches-find-includes.md browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio) 2026-04-22 18:14:39 -04:00
webdriverio-0002-mspo-aggregator-selector-dedup-find.md browser-automation wave 2: testcafe-0001 + webdriverio-0002 2026-04-22 18:31:53 -04:00
weechat-0001-irc-nick-search-linear-scan-protocol-handlers.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
weechat-0002-irc-nick-new-names353-quadratic-dedup.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
wildfly-0001-elytron-securitycontext-threadlocal-leak.md wildfly-0001 UNDF-1305: ElytronSecurityIntegration ThreadLocal leak (MOAD-0003) 2026-04-26 08:29:50 -04:00
wildfly-0002-elytronsecuritydomain-isvalid-threadlocal-leak.md 4 follow-up patches shipped: wildfly-0002 + wildfly-0003 + log4j2-0001 + nakama-0001 2026-04-26 12:30:28 -04:00
wildfly-0003-transactionrollbacksetupaction-depth-remove.md 4 follow-up patches shipped: wildfly-0002 + wildfly-0003 + log4j2-0001 + nakama-0001 2026-04-26 12:30:28 -04:00
wireguard-tools-0001-clean.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
zookeeper-0001-prepRequestProcessor-removeduplicates-acl-quadratic.md whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild 2026-03-27 15:23:43 -04:00
zulip-0001-clean.md comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00

Tickets

# Title Module Severity Status
0001 Tarjan SCC: stack.contains(n) — O(V²) jdk.compiler high open
0002 InferenceGraph.findNode() O(N) scan, called O(N³) total jdk.compiler high open
0003 ModuleHashesBuilder$TopoSorter Deque.contains() java.base medium open
0004 Dependencies$Node.addDependency() List.contains() dedup jdk.compiler low open
0005 InferenceContext.isEquiv() List.containsAll() bound comparison jdk.compiler low open

Pattern

Same defect replicated in 4 locations across 2 modules: O(n) linear collection membership check where O(1) is available.

In every case a flag field, HashSet, or dedicated boolean already exists or is trivially addable. The background bytecode scan of all 69 JDK modules confirmed no additional hits beyond these five. The active field in TarjanNode (0001) is the most direct evidence: maintained correctly, never read.

Cascade

javac compilation
  └─ type inference (Infer.java)
       ├─ GraphSolver.solve()
       │    └─ InferenceGraph.initNodes()
       │         └─ GraphUtils.tarjan()  ← DEFECT 0001: O(V²)
       └─ DeferredAttr.buildStuckGraph()
            └─ canInfluence() × N²
                 ├─ findNode()           ← DEFECT 0002: O(N) per call → O(N³) total
                 └─ closure()           ← DEFECT 0002: uncached O(V+E) per call

jlink image creation
  └─ ModuleHashesBuilder.computeHashes()
       └─ TopoSorter.visit()            ← DEFECT 0003: Deque.contains() O(N)

debug compilation (-XDcompletionDeps)
  └─ Dependencies$GraphDependencies
       └─ Node.addDependency()          ← DEFECT 0004: List.contains() O(N)