# UNDF: UNDF-2026-000000131
# kafka deeper scan — CWE-407 triage

## Scan date: 2026-03-27

## Areas scanned

| Path | Result |
|------|--------|
| `clients/src/main/java/org/apache/kafka/clients/` | **kafka-0008 found** (ListDeserializer) |
| `clients/src/main/java/org/apache/kafka/common/Cluster.java` | CLEAN — Arrays.asList().contains() in nodeIfOnline is O(R) per call, R bounded by replication factor (≤3), not quadratic |
| `clients/src/main/java/org/apache/kafka/common/serialization/ListDeserializer.java` | **kafka-0008** — nullIndexList ArrayList.contains in O(S) loop |
| `clients/src/main/java/org/apache/kafka/clients/admin/internals/ListOffsetsHandler.java` | CLEAN — retriable is HashSet |
| `connect/runtime/src/main/java/org/apache/kafka/connect/connector/policy/AllowlistConnectorClientConfigOverridePolicy.java` | LOW / skip — allowlist is admin-configured small static list, C×A bounded |
| `connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/RestServer.java` | CLEAN — listeners is a short list of protocol strings, O(1) in practice |
| `core/src/main/scala/kafka/server/KafkaApis.scala` | CLEAN — topicIdPartitionSeq is `mutable.Set` (HashSet-backed), contains O(1) |
| `core/src/main/scala/kafka/server/ConfigAdminManager.scala` | CLEAN — alterConfigOps is per-op (single config), oldValueList is a short CSV value list, not partition-scale |
| `core/src/main/scala/kafka/server/KafkaConfig.scala` | CLEAN — listener name checks on small config lists |
| `streams/src/main/java/` | CLEAN — no ArrayList.contains in loops found |

## Defect found

- **kafka-0008**: `ListDeserializer.java` nullIndexList `ArrayList.contains` O(S×N) — patched, 3/3 PASS, 6×–24× measured
