java-topology/whitepaper/outreach/netty-0002.md

Netty — CWE-407 Disclosure Brief (netty-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(R²) defect in Netty's DNS resolver result deduplication. Patched. DnsResolveContext uses ArrayList.contains() for dedup. This is the same defect site as netty/netty-0001 (DNS resolver) but in a different patch variant.

The Defect

netty-0002 (PATCHED — MEDIUM): resolver-dns/src/main/java/io/netty/resolver/dns/DnsResolveContext.java:905

// In DnsResolveContext — dedup on DNS result accumulation:
} else if (isDuplicateAllowed() || !finalResult.contains(converted)) {
    finalResult.add(converted);

finalResult is ArrayList<T>. contains() is O(R) per addition. Total cost: O(R²).

Complexity Proof

At R=100 DNS records:

• Defective: O(R²) = 5,000 comparisons
• Fixed: O(R) with companion HashSet = 100 operations
• 50× op reduction at 100 records.

Impact

Netty powers infrastructure across the Java ecosystem. DNS resolution with dedup fires on every connection to multi-record domains. CDN and cloud service domains with dozens of records trigger the quadratic path.

The Fix

Maintain a companion HashSet<T> alongside the ArrayList<T>:

// Before
!finalResult.contains(converted)     // O(R)

// After
!finalResultSet.contains(converted)  // O(1)
finalResultSet.add(converted);

Patch

Fix available: defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch

Touches DnsResolveContext.java. 50× speedup at 100 DNS records.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (netty/netty).
2. Assess severity — fires on DNS resolution for multi-record domains.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Netty team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.