# UNDF: UNDF-2026-000000352
# axum — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-27
**Source:** https://github.com/tokio-rs/axum (depth=1)
**Scanned:** `axum/src/`, `axum-core/src/` (excluding test modules)

## Summary

No CWE-407 defects found in axum's production code paths.

## Candidates Evaluated

| Location | Pattern | Verdict |
|----------|---------|---------|
| `routing/method_routing.rs:885` | `endpoint_filter.contains(filter)` | **DISQUALIFIED** — `MethodFilter` is a bitflag struct; `.contains()` is bitwise AND, not a linear scan. |
| `routing/method_routing.rs:1233` | `s.contains(method)` in `append_allow_header` | **DISQUALIFIED** — `s` is a comma-separated Allow header string over at most ~9 HTTP methods (bounded constant). |
| `routing/path_router.rs:100` | `for endpoint in self.routes.iter_mut()` | **DISQUALIFIED** — iterates all routes once with no inner membership test; applies a transformation. |
| `extract/ws.rs:257` | `self.sec_websocket_protocol.contains(&proto)` | **DISQUALIFIED** — `sec_websocket_protocol` is a `BTreeSet<HeaderValue>`, not a Vec; O(log N) lookup. |
| `response/sse.rs:315,335,382,450` | `self.flags.contains(...)` | **DISQUALIFIED** — bitflag operations on `EventFlags`. |

## Conclusion

Axum's router uses `matchit` (radix trie) for path dispatch, `BTreeSet` for WebSocket protocol tracking, and bitflags for method filters. No unbounded linear membership tests found.
