# UNDF: UNDF-2026-000000505
# pulsar deeper scan — CWE-407 triage

## Scan date: 2026-03-27

## Areas scanned

| Path | Result |
|------|--------|
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/service/` | CLEAN — consumerList.contains guarded by consumerSet (HashSet), membership check deferred to Set |
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/resourcegroup/ResourceUsageTopicTransportManager.java` | CLEAN — tenantList.contains and nsList.contains are one-shot checks at startup, not in a loop |
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/loadbalance/` | CLEAN — no ArrayList.contains in loops found |
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/` | CLEAN |
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/namespace/` | CLEAN |
| `pulsar-client/src/main/java/org/apache/pulsar/client/impl/customroute/PartialRoundRobinMessageRouterImpl.java` | **pulsar-0005** — CopyOnWriteArrayList.contains in O(N) stream filter |
| `pulsar-client/src/main/java/` (rest) | CLEAN — sharedResources.contains is on a small enum-backed list |
| `managed-ledger/src/main/java/` | CLEAN — String.contains (substring match), not collection membership |
| `pulsar-common/src/main/java/` | CLEAN |

## Defect found

- **pulsar-0005**: `PartialRoundRobinMessageRouterImpl.java` CopyOnWriteArrayList.contains O(N×L) — patched, 3/3 PASS, 18×–71× measured
