java-topology/whitepaper/outreach

CWE-407 Outreach Briefs

2026-03-27 · Confidential pre-disclosure

One focused brief per participant. Each document is standalone — the recipient sees only their own findings, not the full cross-ecosystem map.

157 sites patched. 66 outreach briefs. 52 ecosystems.

---

Files

File	Purpose
send-queue.md	Full email bodies for maintainer pre-disclosure
contacts.md	Cold outreach contacts — press, CVE bodies, researchers, community
email-draft.md	Generic email template

---

Participants

Compilers and Language Runtimes

File	Org	Sites	Status	Severity
javac.md	OpenJDK / Oracle / Amazon Corretto	5	All patched	HIGH
typescript.md	Microsoft TypeScript	3	All patched	HIGH
ghc.md	Haskell Foundation / GHC	4	All patched	HIGH
scala3.md	Scala Center / EPFL	1	Patched	CRITICAL (O(n³))
rustc.md	Rust / rust-lang.org	2	Both patched	HIGH/MEDIUM
kotlin.md	JetBrains / Kotlin	1	Patched	HIGH
gcc.md	GCC Project / FSF	1	Patched	MEDIUM
llvm.md	LLVM / Apple / Google	3	All patched	HIGH
v8.md	Google V8 / Chrome	1	Patched	HIGH
spidermonkey.md	Mozilla SpiderMonkey / Firefox	1	Patched	HIGH

Build Tools and Package Managers

File	Org	Sites	Status	Severity
build-tools.md	Maven, CMake, npm, pip, Composer	8	All patched	MEDIUM
bazel.md	Google Bazel	2	Both patched	HIGH
jenkins.md	CloudBees / Jenkins	2	Both patched	MEDIUM
buildkit.md	Docker / Moby	1	Patched	MEDIUM
luigi.md	Spotify / Luigi	1	Patched	MEDIUM

Language Runtimes and Scripting

File	Org	Sites	Status	Severity
erlang-otp.md	Ericsson / erlang.org	2	1 patched, 1 fixable-upstream	HIGH
swipl.md	SWI-Prolog	3	2 patched, 1 fixable-pending	HIGH

Web Frameworks

File	Org	Sites	Status	Severity
django.md	Django Software Foundation	4	All patched	HIGH/MEDIUM
rails.md	Rails Core / 37signals	11	All patched	HIGH/MEDIUM
pyramid.md	Pylons Project	5	All patched	MEDIUM
bottle.md	bottle.py	1	Patched	MEDIUM

ORM / Database Frameworks

File	Org	Sites	Status	Severity
hibernate.md	Red Hat / Hibernate	5	All patched	HIGH
mybatis.md	MyBatis / Apache	1	Patched	MEDIUM
efcore.md	Microsoft / EF Core	3	All patched	HIGH
sqlalchemy.md	SQLAlchemy	2	Both patched	MEDIUM
peewee.md	coleifer / Peewee	1	Patched	MEDIUM
sequelize.md	Sequelize	2	Both patched	MEDIUM
typeorm.md	TypeORM	3	All patched	HIGH
doctrine.md	Doctrine Project / Symfony	3	All patched	HIGH
seaorm.md	SeaQL / SeaORM	4	All patched	HIGH
diesel.md	Diesel ORM / Rust	3	All patched	MEDIUM
gorm.md	GORM / go-gorm	1	Patched	MEDIUM
exposed.md	JetBrains / Exposed	3	All patched	HIGH

Databases

File	Org	Sites	Status	Severity
postgresql.md	PostgreSQL Core Team	5	3 patched, 2 deferred	HIGH
mongodb.md	MongoDB Inc.	7	4 patched, 1 deferred, 2 NWF	HIGH

Game Engines and Graphics

File	Org	Sites	Status	Severity
godot.md	Godot Engine	4	All patched	HIGH
pygame.md	pygame / Python	4	All patched	HIGH
sfml.md	SFML	5	All patched	HIGH
threejs.md	Three.js / mrdoob	5	All patched	HIGH
angelscript.md	AngelScript	3	All patched	HIGH
dry.md	Dry (Urho3D fork)	2	Both patched	HIGH
tinkerpop.md	Apache TinkerPop / Gremlin	1	Patched	CRITICAL (O(n²) per traverser)

Blockchain / Smart Contracts

File	Org	Sites	Status	Severity
solidity.md	Ethereum Foundation	2	Both patched	HIGH/MEDIUM

Network Routing / SDN

File	Org	Sites	Status	Severity
frrouting.md	FRRouting / LFN	2	Both patched	HIGH
bird.md	CZ.NIC / BIRD	2	Both patched	HIGH
onos.md	ON.Lab / ONOS	1	Patched	HIGH
httpd.md	Apache httpd	1	Patched	MEDIUM

Infrastructure / DevOps / Automation

File	Org	Sites	Status	Severity
terraform.md	HashiCorp / Terraform	2	Both patched	HIGH
ansible.md	Red Hat / Ansible	2	Both patched	HIGH
saltstack.md	VMware / SaltStack	1	Patched	MEDIUM
cfengine.md	Northern.tech / CFEngine	3	All patched	HIGH
puppet.md	Puppet / Perforce	1	Patched	MEDIUM

Code Quality Tools (Ruby)

File	Org	Sites	Status	Severity
rubocop.md	RuboCop / Ruby	2	Both patched	MEDIUM
solargraph.md	Solargraph / Ruby LSP	2	Both patched	MEDIUM

Graph / Data Science

File	Org	Sites	Status	Severity
networkx.md	NetworkX / Python	1	Patched	MEDIUM

Messaging / Scientific / Other

File	Org	Sites	Status	Severity
rabbitmq.md	VMware / RabbitMQ	1	Patched	HIGH
kicad.md	KiCad EDA	1	Patched	HIGH
octave.md	GNU Octave	1	Patched	MEDIUM
tor.md	Tor Project	1	Patched	MEDIUM
minecraft.md	Mojang / Microsoft	2 + 1 mod	Unpatched	EXPONENTIAL

---

Sequencing

Wave 1 — Build tools, low blast radius: build-tools.md → erlang-otp.md → swipl.md → tor.md

Wave 2 — Compilers (coordinated, same window): javac.md, typescript.md, ghc.md, scala3.md, rustc.md, kotlin.md, llvm.md, gcc.md

Wave 3 — Infrastructure and databases: postgresql.md, mongodb.md, frrouting.md, bird.md, onos.md, terraform.md

Wave 4 — Web frameworks and ORMs: django.md, rails.md, hibernate.md, efcore.md, typeorm.md, sqlalchemy.md

Wave 5 — Remaining ORMs and frameworks: doctrine.md, seaorm.md, diesel.md, sequelize.md, gorm.md, exposed.md, peewee.md, mybatis.md, pyramid.md, bottle.md, rubocop.md, solargraph.md

Wave 6 — Game engines and graphics: godot.md, pygame.md, sfml.md, threejs.md, angelscript.md, dry.md, tinkerpop.md

Wave 7 — DevOps and CI: ansible.md, saltstack.md, cfengine.md, puppet.md, jenkins.md, bazel.md, buildkit.md, luigi.md

Wave 8 — Runtimes, browsers, other: v8.md, spidermonkey.md, rabbitmq.md, kicad.md, networkx.md, octave.md, httpd.md

Wave 9 — High-visibility / public-facing: solidity.md, minecraft.md

---

Contact template

Subject: Pre-disclosure: CWE-407 in [tool] — coordinated disclosure request

We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in [tool]. We have a patch, complexity proof, and benchmark. We are requesting a 90-day coordinated disclosure window before public release.

Details and patch attached.

Contact: security@undefect.com