Apache Pulsar — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Apache Pulsar's client and functions runtime. One causes O(N²) topic grouping deduplication in GetTopicsResult; the other causes O(F×K) schema field scanning in JavaInstanceRunnable. Patches ready for upstream review.

The Defects

pulsar-0001 (PATCHED — HIGH): client/.../GetTopicsResult.java:117

// Inside GetTopicsResult — for loop over topic list:
List<String> grouped = new ArrayList<>();
for (String topic : topicList) {
    if (!grouped.contains(topic)) {  // O(N) ArrayList.contains() per topic
        grouped.add(topic);
    }
}
// O(N²) topic dedup

grouped.contains() performs O(N) scan per topic. O(N²) total dedup. Measured ratio: 25×.

pulsar-0002 (PATCHED — HIGH): functions/runtime/.../JavaInstanceRunnable.java:987

// Inside schema field resolution — per field per key:
if (allFields.contains(fieldName)) { ... }  // O(F) List.contains() per key
// O(F×K) total

allFields.contains() O(F) per key in schema field scanning. O(F × K). Measured ratio: 87×.

Complexity Proof

pulsar-0001: For N=25 topics:

O(N²) = 625 comparisons
Fixed: LinkedHashSet → O(N)
25× measured ratio.

pulsar-0002: For F=87 fields, K keys per function invocation:

O(F×K) — 87× measured ratio.

Impact

pulsar-0001 affects all Pulsar clients using topic pattern subscriptions and multi-topic consumers — a common pattern for consuming from multiple topics. pulsar-0002 affects all Pulsar Functions using schema-aware processing — the Pulsar Functions API for stateful stream processing. Apache Pulsar is a cloud-native messaging platform used in high-throughput event streaming. Large multi-topic subscriptions hit pulsar-0001 on every topic list resolution.

The Fix

pulsar-0001: Replace grouped ArrayList with LinkedHashSet:

// Before
List<String> grouped = new ArrayList<>();
if (!grouped.contains(topic)) { grouped.add(topic); }

// After
// CWE-407 fix: LinkedHashSet for O(1) dedup instead of O(N) ArrayList.contains().
Set<String> grouped = new LinkedHashSet<>();
grouped.add(topic);  // Set.add() is idempotent

pulsar-0002: Replace allFields list with LinkedHashSet in JavaInstanceRunnable.

Patch

defects/pulsar/patch/pulsar-0001-0002-topics-fields-set.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or JIRA reference.
Validate the patch against your client and functions runtime test suites.
Assess CVE eligibility — pulsar-0002 measured at 87× in schema field scanning.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Blame History Unescape Escape