russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely. |
||
|---|---|---|
| .. | ||
| build-tools.md | ||
| email-draft.md | ||
| erlang-otp.md | ||
| frrouting.md | ||
| ghc.md | ||
| header-body.html | ||
| header.html | ||
| hive.md | ||
| javac.md | ||
| kafka.md | ||
| MD5SUMS | ||
| minecraft.md | ||
| mongodb.md | ||
| outreach-style.css | ||
| postgresql.md | ||
| presto.md | ||
| README.md | ||
| rustc.md | ||
| scala3.md | ||
| send-queue.md | ||
| solidity.md | ||
| spark.md | ||
| spring.md | ||
| swipl.md | ||
| tor.md | ||
| typescript.md | ||
| webpack.md | ||
CWE-407 Outreach Briefs
2026-03-26 · Confidential pre-disclosure
One focused brief per participant. Each document is standalone — the recipient sees only their own findings, not the full cross-ecosystem map.
Participants
| File | Org | Sites | Status | Severity |
|---|---|---|---|---|
| javac.md | OpenJDK / Oracle / Amazon Corretto | 5 | All patched | HIGH |
| typescript.md | Microsoft TypeScript | 3 | All patched | HIGH |
| ghc.md | Haskell Foundation / GHC | 4 | All patched | HIGH |
| scala3.md | Scala Center / EPFL | 1 | Patched | CRITICAL (O(n³)) |
| rustc.md | Rust / rust-lang.org | 2 | Both patched | HIGH/MEDIUM |
| erlang-otp.md | Ericsson / erlang.org | 2 | 1 patched, 1 fixable-upstream | HIGH |
| swipl.md | SWI-Prolog | 3 | 2 patched, 1 fixable-pending | HIGH |
| postgresql.md | PostgreSQL Core Team | 5 | 3 patched, 2 deferred | HIGH |
| mongodb.md | MongoDB Inc. | 7 | 4 patched, 1 deferred, 2 NWF | HIGH |
| frrouting.md | FRRouting / LFN | 2 | 1 patched, 1 unpatched | HIGH |
| tor.md | Tor Project | 1 | Unpatched | MEDIUM |
| solidity.md | Ethereum Foundation | 2 | Both unpatched | HIGH/MEDIUM |
| minecraft.md | Mojang / Microsoft | 2 + 1 mod | Unpatched | EXPONENTIAL |
| build-tools.md | Maven, CMake, npm, pip, Composer | 8 | All patched | MEDIUM |
Sequencing
Wave 1 — Lowest blast radius, easiest disclosure: build-tools.md → erlang-otp.md → swipl.md → tor.md
Wave 2 — Compilers (coordinated, same window): javac.md, typescript.md, ghc.md, scala3.md, rustc.md
Wave 3 — Infrastructure (longer lead time): postgresql.md, mongodb.md, frrouting.md
Wave 4 — High-visibility / public-facing: solidity.md, minecraft.md
Contact template
Subject: Pre-disclosure: CWE-407 in [tool] — coordinated disclosure request
We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in [tool]. We have a patch, complexity proof, and benchmark. We are requesting a 90-day coordinated disclosure window before public release.
Details and patch attached.
Contact: security@undefect.com