JanusGraph — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in JanusGraph's query condition system. MultiCondition extends ArrayList<Condition>, inheriting O(N) contains() in addConstraint(). Every constraint addition performs a linear deduplication scan. Patch ready for upstream review.

The Defects

janusgraph-0001 (PATCHED — HIGH): janusgraph-core/.../MultiCondition.java:29

// MultiCondition extends ArrayList<Condition>
// Inside addConstraint():
public class MultiCondition<E extends Element> extends ArrayList<Condition<E>> {
    public boolean addConstraint(Condition<E> cond) {
        if (!this.contains(cond)) {  // O(N) ArrayList.contains() scan
            return add(cond);
        }
        return false;
    }
}

MultiCondition inherits ArrayList.contains() which performs a linear scan over all N already-added conditions. Called on every constraint addition during query planning: O(N²) total for N constraints.

Complexity Proof

For N query constraints:

addConstraint() called N times
Each call scans up to N existing entries
Total: O(N²)

At N=400: defective=80,000 comparisons, fixed=400 hash lookups. Measured ratio: 400×.

Impact

Every JanusGraph query that builds MultiCondition constraint sets. Affected workloads include complex graph traversals with many filters, Gremlin queries with multiple has() steps, and index-backed queries with compound predicates. JanusGraph is deployed in large-scale graph applications at major technology companies for fraud detection and network analysis.

The Fix

Add a parallel HashSet<Condition> shadow alongside the ArrayList:

// Before
public class MultiCondition<E extends Element> extends ArrayList<Condition<E>> {
    public boolean addConstraint(Condition<E> cond) {
        if (!this.contains(cond)) {
            return add(cond);
        }
        return false;
    }
}

// After
// CWE-407 fix: parallel HashSet for O(1) contains() dedup.
public class MultiCondition<E extends Element> extends ArrayList<Condition<E>> {
    private final Set<Condition<E>> conditionSet = new HashSet<>();

    public boolean addConstraint(Condition<E> cond) {
        if (conditionSet.add(cond)) {
            return add(cond);
        }
        return false;
    }
}

Patch

defects/janusgraph/patch/janusgraph-0001-multicondition-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or JIRA reference.
Validate the patch against your query planning test suite.
Assess CVE eligibility — fires on every complex multi-constraint query.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Blame History Unescape Escape