java-topology/whitepaper/outreach/iroh-0001.md

Iroh — CWE-407 Disclosure Brief (iroh-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Iroh's relay server access control. The AccessConfig enum stores allowlists and denylists as Vec<EndpointId>, causing O(N) linear scans on every endpoint connection check.

The Defect

iroh-0001 (PATCHED — MEDIUM): iroh-relay/src/main.rs

enum AccessConfig {
    Everyone,
    Allowlist(Vec<EndpointId>),   // O(N) membership check per connection
    Denylist(Vec<EndpointId>),    // O(N) membership check per connection
}

When a relay server uses allowlist or denylist access control, every incoming endpoint connection triggers a linear scan of the entire list. For a relay serving thousands of endpoints with an access list of hundreds of entries, this produces O(C*L) total cost where C = connections and L = list size.

Complexity Proof

At L=500 list entries, C=1,000 connections:

• Defective: 1,000 × 250 (avg) = 250,000 comparisons
• Fixed: 1,000 × O(1) hash lookups = 1,000 operations
• ~250× op reduction.

Impact

Iroh is a networking toolkit for building distributed systems, used for peer-to-peer file sync and real-time collaboration. Relay servers handle connection mediation when direct connections fail. Large deployments with access control lists experience quadratic overhead on every connection attempt.

The Fix

Replace Vec<EndpointId> with HashSet<EndpointId> for O(1) membership testing:

// Before
Allowlist(Vec<EndpointId>),
Denylist(Vec<EndpointId>),

// After
Allowlist(HashSet<EndpointId>),
Denylist(HashSet<EndpointId>),

Patch

Fix available: defects/iroh-0001/patch/iroh-0001.patch

Single-file patch in iroh-relay/src/main.rs. Type change from Vec to HashSet. ~250× speedup at 500 list entries.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (n0-computer/iroh).
2. Assess severity — fires on every endpoint connection attempt when access control is enabled.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Iroh team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.