# UNDF: UNDF-2026-000000477
# nomad-0002: stream/subscription filter() — O(events × namespaces)

## CWE
CWE-407: Inefficient Algorithmic Complexity

## Severity
MEDIUM

## Location
`nomad/stream/subscription.go:142`

## Description
The `filter()` function iterates over all incoming events and for each event
calls `slices.Contains(req.Namespaces, event.Namespace)` — a linear scan over
the namespace allowlist.

```go
for _, event := range events {
    if event.Namespace != "" && !slices.Contains(req.Namespaces, event.Namespace) {
        continue
    }
    ...
}
```

With E events per batch and N subscribed namespaces: O(E × N).

## Fix
Build a `map[string]struct{}` from `req.Namespaces` once before the loop
(or store it pre-built on `SubscribeRequest`).

## Speedup
~Nx where N = number of subscribed namespaces; worst case in large multi-tenant
clusters with many namespace subscriptions.
