Speed up /vulnerabilities and filtered /software/versions queries (#45564)

Address 100% DB CPU spikes observed when paginating these endpoints with
filters. Two root causes: cve_meta and vulnerability_host_counts lack
indexes for the actual filter shapes, and ListVulnerabilities ran
correlated scalar subqueries on every row of vulnerability_host_counts
that matched the scope (1.1M rows examined per call).

Add three online indexes:
- cve_meta(cisa_known_exploit, cve) for the exploit filter
- cve_meta(cvss_score, cve) for the CVSS range filter
- vulnerability_host_counts(global_stats, team_id, host_count, cve) for
the scope filter on the vulnerabilities endpoint

Refactor ListVulnerabilities into a two-stage query: an inner query
filters, sorts, and paginates vulnerability_host_counts (with an
optional LEFT JOIN to cve_meta for sort/filter columns), and an outer
query enriches only the paginated page with the created_at and source
scalar subqueries. Net effect: the heavy subqueries run perPage times
(~20-100) instead of millions. Sort-by-created_at falls back to the
single-statement form since the sort key is itself the subquery result.

CountVulnerabilities drops the redundant DISTINCT (vhc.cve is already
unique within a (global_stats, team_id) scope via the existing UNIQUE
KEY) and only joins cve_meta when KnownExploit filtering is requested.

**Related issue:** Resolves #45415
This commit is contained in:
Dante Catalfamo
2026-06-08 17:02:47 -04:00
committed by GitHub
parent 19ba1ed787
commit ad30812054
9 changed files with 988 additions and 66 deletions
@@ -0,0 +1 @@
- Fixed latency issues with /vulnerabilities and filtered /software/versions queries