java-topology/whitepaper/outreach/conduit.md

Conduit — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(Q×E) defect in Conduit (Matrix homeserver, Rust) in the federation backfill endpoint. Vec::contains() over earliest_events fires inside a BFS loop that grows with each queued event. Patched.

The Defects

conduit-0001 (PATCHED — MEDIUM): src/api/server_server.rs:1281

// In get_missing_events_route — fires per queued event during federation backfill:
if body.earliest_events.contains(&queued_events[i]) {  // O(E) linear scan
    i += 1;
    continue;
}

body.earliest_events is a Vec. contains() is O(E) where E = number of earliest events. This check fires inside a BFS loop that processes queued events (size Q, growing as the loop discovers parents). Total cost: O(Q × E).

During federation backfill, a remote server requests missing events between earliest_events and latest_events. The BFS loop walks the event DAG backward. Each iteration checks whether the current event matches any earliest boundary event.

Complexity Proof

At Q=500 queued events (deep backfill), E=50 earliest events:

• Defective: 500 × 50 = 25,000 comparisons
• Fixed: 500 × 1 = 500 hash lookups
• 50× op reduction.

Impact

Conduit serves Matrix federation traffic. The get_missing_events endpoint handles backfill requests from other homeservers joining rooms. Rooms with deep history and many participating servers generate large backfill requests. A federated room with thousands of events and many join points produces large earliest_events lists and deep BFS traversals.

The Fix

Convert earliest_events to a HashSet before the loop:

// Before
if body.earliest_events.contains(&queued_events[i])

// After — O(1) membership via HashSet
let earliest_set: HashSet<_> = body.earliest_events.iter().cloned().collect();
if earliest_set.contains(&queued_events[i])

Patch

Fix available: defects/conduit/patch/conduit-0001-earliest-events-hashset.patch

Single-file patch in src/api/server_server.rs.

Unit test: pass. 50× op reduction at 500 events × 50 boundaries.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitLab/GitHub issue reference (famedly/conduit).
2. Assess severity — fires on every federation backfill request, cost scales with room history depth.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Conduit team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.