# PgBouncer — CLEAN (CWE-407)

Scanned 2026-03-30.

PgBouncer uses efficient data structures throughout:
- **User lookup**: AA-tree (`aatree_search`) — O(log N)
- **Prepared statements**: uthash — O(1)
- **Session variable cache**: uthash — O(1)
- **HBA name sets**: cbtree (crit-bit tree) for >10 entries — O(log N)
- **Database lookup**: `find_database()` is linear scan of `database_list`,
  but databases are configuration-bounded (typically <100), not attacker-controlled.

No CWE-407 defect found.
