# UNDF: UNDF-2026-000000350
# ActiveMQ Artemis CWE-407 Scan — CLEAN (beyond artemis-0001)

**Date:** 2026-03-28
**Repo:** https://github.com/apache/activemq-artemis
**Scan scope:** `artemis-server/src/main/java/org/apache/activemq/artemis/core/` —
postoffice, server/impl, paging, persistence, security, transaction, replication, cluster,
filter, group; plus `artemis-protocols/` (AMQP, OpenWire, STOMP).

## Findings

No new confirmed CWE-407 defects found beyond existing artemis-0001.

### Candidates examined

| File | Location | Pattern | Verdict |
|------|----------|---------|---------|
| `BindingsImpl.java` | `routeFromCluster` | `idsToAckList.contains(bindingID)` in byte-buffer loop | PATCHED (artemis-0001) |
| `RoutingContextImpl.java` | `RouteContextList.ackedQueues` | `ackedQueues.contains(queue)` (ArrayList) called from `processRouteToDurableQueues` | CLEAN — `ackedQueues` is populated via `addQueueWithAck` which is called once per `QueueImpl.routeWithAck`; list remains ≤1 entry per address per routing context (durable queue ArrayList is sized `(1)`). Not an outer loop over a growing list. |
| `RemoteQueueBindingImpl.java` | `route()` | `getDurableQueues().contains(storeAndForwardQueue)` | CLEAN — `durableQueue` is `ArrayList(1)`; O(1) scan for a list bounded to 1 element per address. |
| `ClusterConnectionImpl.java` | `nodeUP()` | `allowableConnections.contains(...)` | CLEAN — `allowableConnections` is `HashSet`; O(1). |
| `ColocatedHAManager.java` | `updateAcceptorsAndConnectors` | `remoteConnectors.contains(entry.getValue().getName())` in connector loop | CLEAN — admin/startup path only; connector counts are bounded (single-digit). |
| `MBeanInfoHelper.java` | `getMBeanAttributesInfo` | `alreadyAdded.contains(name)` in nested loop over methods | CLEAN — results are cached in `attributesInfoCache`; called once per MBean interface class at registration time, not per-message. |
| `SecurityStoreImpl.java` | `checkAuthorizationCache` | `act.contains(dest)` | CLEAN — `act` is `ConcurrentHashSet`; O(1). |
| `QueueImpl.java` | `transferTo` | `targetDuplicateCache.contains(duplicateBytes)` | CLEAN — `DuplicateIDCache` uses `ConcurrentHashMap`; O(1). |
| `PageCursorProviderImpl.java` | `cleanupMiddleStream` | `depagedPagesSet.contains(pageID)` | CLEAN — `depagedPagesSet` is `LongHashSet`; O(1). |
| `AMQPMessage.java` | `isAccepted` | `rejectedConsumers.contains(consumer)` | CLEAN — `rejectedConsumers` is `HashSet`; O(1). |
| `AMQPFederationAddressPolicyManager.java` | `afterQueueAdded` | `divert.getValue().contains(queueBinding)` | CLEAN — value is `Set<QueueBinding>`; O(1). |
| `AMQConsumer.java` | `isRolledBack` | `rollbackedMessageRefs.contains(ref)` | CLEAN — `rollbackedMessageRefs` is `Set`; O(1). |
| `ArtemisRbacInvocationHandler.java` | `invoke` | `mBeanServerCheckedMethods.contains(...)` | CLEAN — `List.of(...)` with 7 static entries; effectively O(1). |
| `ResourceManagerImpl.java` | `getHeuristicCommittedTransactions` | `List<Xid>` returned, then `.contains()` called by `ServerSessionImpl` | CLEAN — heuristic completions list is always tiny (admin-path, zero in normal operation). |

## Summary

All `ArrayList.contains()` / `List.contains()` patterns found in the hot message routing
paths use sets, maps, bounded lists, or cached structures. The single confirmed defect
(artemis-0001, `routeFromCluster` `idsToAckList`) has been patched. No further
CWE-407 defects found in the Artemis codebase within scan scope.
