1.5 KiB
Apache Kylin — CWE-407 Disclosure Brief
Project: Apache Kylin (OLAP on Hadoop) Disclosure date: 2026-03-27 Severity: MEDIUM Speedup: 21.7× Status: PATCHED
Finding
Apache Kylin's JDBC job scheduler scans a growing list of job IDs using List.contains() inside a timer loop, producing O(J²) behavior under sustained job load. Replacing the list with a HashSet yields a 21.7× speedup at production job-queue depths.
The Defect(s)
| ID | Location | Pattern | Complexity |
|---|---|---|---|
| kylin-0001 | scheduler/JdbcJobScheduler.java:417 |
jobInfoIds.contains() inside scheduler timer loop |
O(J²) |
Complexity Proof
Let J = jobs tracked in jobInfoIds. Each timer tick calls jobInfoIds.contains() — O(J) — for each of J jobs: O(J²) per tick. At J=1,000, that is 1M comparisons per scheduler tick.
Impact
Production Kylin deployments with large concurrent job queues. Scheduler timer threads become CPU-bound; segment building is delayed; query fan-out degrades quadratically with job count.
The Fix
- List<String> jobInfoIds = new ArrayList<>();
+ Set<String> jobInfoIds = new HashSet<>();
What We Ask
Please review and apply. We request 90-day coordinated disclosure before public release. Reply to security@undefect.com.
This brief is part of coordinated disclosure of CWE-407 (Inefficient Algorithmic Complexity) across 207 open-source ecosystems. Full report: https://undefect.com