java-topology/whitepaper/outreach/telegraf.md

Telegraf — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Telegraf's dedup processor. The Apply() method compares metric fields by calling m.GetField(f.Key) which performs a linear scan of the cached metric's field list, producing O(F²) per metric comparison. Patched.

The Defects

telegraf-0001 (PATCHED — MEDIUM): plugins/processors/dedup/dedup.go

// In Dedup.Apply() — fires per incoming metric:
for _, f := range metric.FieldList() {
    if value, ok := m.GetField(f.Key); ok {  // GetField is O(F) linear scan
        if value != f.Value {
            changed = true
            break
        }
    }
}

m.GetField(f.Key) performs a linear scan of the cached metric's field list. For each incoming metric with F fields, the comparison cost is O(F_new × F_cached) per metric.

Complexity Proof

telegraf-0001: At F=100 fields (common for system/CPU/disk metrics):

• Defective: 100 × 100 = 10,000 comparisons per metric
• Fixed: 100 × 1 = 100 hash lookups
• ~100× op reduction per metric. Fires on every metric through the dedup processor.

Impact

Telegraf is InfluxData's open-source metrics collection agent, deployed on millions of servers worldwide. The dedup processor is a common pipeline component used to suppress duplicate metric emissions. System, CPU, and disk metrics routinely carry 10-50 fields, with some exceeding 100. At high collection frequencies (10s intervals) across thousands of metrics, the quadratic field comparison adds measurable CPU overhead.

The Fix

telegraf-0001: Build a map from cached metric fields for O(1) lookup:

// Before — O(F²) per metric
if value, ok := m.GetField(f.Key); ok { ... }

// After — O(F) per metric
cachedFields := make(map[string]interface{}, len(m.FieldList()))
for _, cf := range m.FieldList() {
    cachedFields[cf.Key] = cf.Value
}
if value, ok := cachedFields[f.Key]; ok { ... }

Patch

Fix available: defects/telegraf/patch/telegraf-0001-dedup-getfield-quadratic.patch

Single-file patch in plugins/processors/dedup/dedup.go.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (influxdata/telegraf).
2. Assess severity — fires on every metric through the dedup processor pipeline.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Telegraf team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.