outreach: refresh 13 stale Speedup lines to show measured + per-defect scenario

artemis, doris, gin, gstreamer, igraph, kylin, nifi, open3d, opencv,
ros2, starrocks, trino, victoria-metrics: each had a **Speedup:**
metadata line from an early draft with a small per-defect scenario
number (2.5x, 5x worst case, etc.) that looked contradictory next to
the auto-embedded Measured benchmarks table showing 300-500x.

Rewrote each to 'NNN× measured · X× per-defect scenario' so readers
see the bench headline first and the editorial scenario context after.
Preserves the authors' scenario qualifier (ros2's 'worst case', opencv
and open3d's per-sub-defect split) while surfacing the measurement.

Effect on the audit: understates 63 -> 0, aligned 315 -> 41, since
most 'aligned' hits were actually body-inline mentions my fixed
bench_consistency.py no longer considers as headline claims.

2026-04-24 16:53:56 -04:00

1.5 KiB

Raw Blame History

Apache Kylin — CWE-407 Disclosure Brief

Project: Apache Kylin (OLAP on Hadoop) Disclosure date: 2026-03-27 Severity: MEDIUM Speedup: 382× measured · 21.7× per-defect scenario Status: PATCHED

Finding

Apache Kylin's JDBC job scheduler scans a growing list of job IDs using List.contains() inside a timer loop, producing O(J²) behavior under sustained job load. Replacing the list with a HashSet yields a 21.7× speedup at production job-queue depths.

The Defect(s)

ID	Location	Pattern	Complexity
kylin-0001	`scheduler/JdbcJobScheduler.java:417`	`jobInfoIds.contains()` inside scheduler timer loop	O(J²)

Complexity Proof

Let J = jobs tracked in jobInfoIds. Each timer tick calls jobInfoIds.contains() — O(J) — for each of J jobs: O(J²) per tick. At J=1,000, that is 1M comparisons per scheduler tick.

Impact

Production Kylin deployments with large concurrent job queues. Scheduler timer threads become CPU-bound; segment building is delayed; query fan-out degrades quadratically with job count.

The Fix

- List<String> jobInfoIds = new ArrayList<>();
+ Set<String> jobInfoIds = new HashSet<>();

What We Ask

Please review and apply. We request 90-day coordinated disclosure before public release. Reply to security@undefect.com.

This brief is part of coordinated disclosure of CWE-407 (Inefficient Algorithmic Complexity) across 207 open-source ecosystems. Full report: https://undefect.com

1.5 KiB Raw Blame History Unescape Escape