# UNDF: UNDF-2026-000000315
## Tomcat — CWE-407 scan result: CLEAN for connector/mapper/session (beyond tomcat-0002)

Files scanned:
- `java/org/apache/catalina/connector/CoyoteAdapter.java` — `getEffectiveSessionTrackingModes()` returns `Set<SessionTrackingMode>` (EnumSet), O(1) contains. CLEAN.
- `java/org/apache/catalina/mapper/Mapper.java` — `removeWelcomeFile()` linear scan is administrative (not per-request). CLEAN.
- `java/org/apache/catalina/session/ManagerBase.java` — session storage uses `ConcurrentHashMap`, no linear membership tests in hot paths. CLEAN.
- `java/org/apache/catalina/filters/CorsFilter.java` — `allowedHttpMethods` and `allowedHttpHeaders` are `HashSet<String>`, O(1) contains. CLEAN.

New defect tomcat-0002 found in `java/org/apache/catalina/tribes/util/Arrays.merge()` (separate patch file).
