Edit ndaal-sa-2026-041

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

nvulnlookup v0.1.42 splits the daemon's tokio runtime so HTTP serving and the background feeder scheduler run on independent multi-thread executors.  Releases v0.1.0 through v0.1.41 spawned every feeder loop via `tokio::spawn(...)` onto the same 4-worker runtime that served HTTP.  Heavy CPU-bound feeder phases — CWE enrichment scan across ~300 000 stored vulnerabilities, NVD JSON page parses, the 72 MB Debian Security Tracker JSON parse, and EPSS bulk-CSV gz decompression — saturated all 4 workers simultaneously, leaving no async capacity for operator-facing HTTP requests.  Symptom: `/dashboards/*`, `/api/v1/*`, and `/stats` timed out for several minutes per feeder cycle while the daemon log showed feeders making forward progress.

v0.1.42 introduces a new `crates/vl-web/src/feeder_runtime.rs` module that constructs a SEPARATE `tokio::runtime::Runtime` for feeders.  The `#[tokio::main]` runtime that serves HTTP is trimmed from `worker_threads = 4` to `worker_threads = 2` since it no longer competes with feeders.  All 25 `tokio::spawn(...)` sites in the feeder block of `crates/vl-web/src/main.rs` are rewritten to `feeder_handle.spawn(...)`; the 2 remaining `tokio::spawn(...)` calls (HTTP TLS handshake task at line 1255 and the QUIC listener at line 1810) stay on the HTTP runtime as designed.  Worker count on the new feeder runtime defaults to 4 and is overridable via the `VL_FEEDER_WORKER_THREADS` environment variable (range 1..=64; out-of-range values fall back to the default).

Net effect on a v0.1.42 production deployment: HTTP latency stays bounded under feeder load.  An operator hitting `/dashboards/cwe` while the CWE enrichment scan is running gets a sub-second response instead of the multi-minute timeout v0.1.41 would have produced.  Total daemon worker capacity is unchanged (4 workers → 2 HTTP + 4 feeder) — only the isolation changes.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel