1.7 KiB
1.7 KiB
UNDF: UNDF-2026-000000131
kafka deeper scan — CWE-407 triage
Scan date: 2026-03-27
Areas scanned
| Path | Result |
|---|---|
clients/src/main/java/org/apache/kafka/clients/ |
kafka-0008 found (ListDeserializer) |
clients/src/main/java/org/apache/kafka/common/Cluster.java |
CLEAN — Arrays.asList().contains() in nodeIfOnline is O(R) per call, R bounded by replication factor (≤3), not quadratic |
clients/src/main/java/org/apache/kafka/common/serialization/ListDeserializer.java |
kafka-0008 — nullIndexList ArrayList.contains in O(S) loop |
clients/src/main/java/org/apache/kafka/clients/admin/internals/ListOffsetsHandler.java |
CLEAN — retriable is HashSet |
connect/runtime/src/main/java/org/apache/kafka/connect/connector/policy/AllowlistConnectorClientConfigOverridePolicy.java |
LOW / skip — allowlist is admin-configured small static list, C×A bounded |
connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/RestServer.java |
CLEAN — listeners is a short list of protocol strings, O(1) in practice |
core/src/main/scala/kafka/server/KafkaApis.scala |
CLEAN — topicIdPartitionSeq is mutable.Set (HashSet-backed), contains O(1) |
core/src/main/scala/kafka/server/ConfigAdminManager.scala |
CLEAN — alterConfigOps is per-op (single config), oldValueList is a short CSV value list, not partition-scale |
core/src/main/scala/kafka/server/KafkaConfig.scala |
CLEAN — listener name checks on small config lists |
streams/src/main/java/ |
CLEAN — no ArrayList.contains in loops found |
Defect found
- kafka-0008:
ListDeserializer.javanullIndexListArrayList.containsO(S×N) — patched, 3/3 PASS, 6×–24× measured