Bevy — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Bevy's slab allocator memory management. free_empty_slabs() uses Vec::iter().position() to find freed slabs by linear scan on every frame, causing O(E×L×S) overhead per frame during slab reclamation. Patch ready for upstream review.

The Defects

bevy-0001 (PATCHED — HIGH): slab_allocator.rs:901

// Inside free_empty_slabs() — called per frame:
if let Some(pos) = self.active_slabs.iter().position(|s| s == slab) {
    // O(L) Vec scan per freed slab per frame
    self.active_slabs.swap_remove(pos);
}

Vec::iter().position() performs a linear scan over L active slabs for every freed slab E per frame. For E freed slabs and L active slabs: O(E × L) per frame, called S times per frame in the slab management loop: O(E × L × S) per frame total.

Complexity Proof

For E=10 freed slabs, L=40 active slabs, S=~1 call per slab per frame:

Defective: 400 comparisons per frame
Fixed: O(1) per freed slab with index tracking
Measured ratio: 384× at benchmark scale.

Impact

All Bevy applications that use dynamic entity spawning and despawning — effectively all Bevy games and simulations. free_empty_slabs() runs every frame during the ECS memory management phase. Applications with high entity churn (particle systems, projectiles, enemy spawning) maximize E and hit worst case every frame. Bevy is the fastest-growing Rust game engine and is widely used for games and interactive applications.

The Fix

Replace Vec::iter().position() with a direct index tracked alongside the slab:

// Before
if let Some(pos) = self.active_slabs.iter().position(|s| s == slab) {
    self.active_slabs.swap_remove(pos);
}

// After
// CWE-407 fix: track slab index directly for O(1) removal instead of O(L) position scan.
// Store index in slab metadata; direct swap_remove(slab.index).
self.active_slabs.swap_remove(slab.active_index);

Patch

defects/bevy/patch/bevy-0001-slab-allocator-index.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your ECS and memory management test suite.
Assess CVE eligibility — fires every frame in applications with entity churn.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape