java-topology/whitepaper/outreach/drone-0002.md

Drone — CWE-362 Disclosure Brief (drone-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One thundering-herd defect in Drone CI's TTL cache. Concurrent cache misses for the same key trigger duplicate backend fetches. Patched with a singleflight pattern. Patch ready for upstream review.

The Defects

drone-0002 (PATCHED — MEDIUM): cache/ttl_cache.go:200

// In Get() — fires on every cache miss:
item, err := c.getter.Find(ctx, key)

When multiple goroutines simultaneously miss the cache for the same key, each independently calls c.getter.Find(), issuing duplicate database queries. With G concurrent goroutines missing on the same key, G identical backend fetches fire instead of 1.

Complexity Proof

At G=50 concurrent goroutines missing on the same key:

• Defective: 50 backend fetches
• Fixed: 1 backend fetch (singleflight)
• 50x reduction in backend load per cache-miss burst.

Impact

Drone CI's TTL cache backs repository and pipeline metadata lookups. During build bursts (webhook storms, monorepo PRs affecting many pipelines), many goroutines miss the cache simultaneously for the same repository, creating a thundering herd on the database.

The Fix

Wrap the cache-miss fetch in a singleflight group so concurrent misses share a single backend call:

// Before
item, err := c.getter.Find(ctx, key)

// After
item, err, _ := c.group.Do(key, func() (V, error) {
    return c.getter.Find(ctx, key)
})

Patch

Fix available: defects/drone-0002/patch/drone-0002.patch

Single-file patch on cache/ttl_cache.go. 50x backend load reduction at G=50 concurrent misses.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (harness/drone).
2. Assess severity — thundering herd on cache miss; scales with concurrency.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Drone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.