# Tomcat — Diamond Recursion (CWE-407 O(2^D)) Scan: CLEAN

**Pattern:** Recursive cycle-detection / dependency traversal without a visited set
(exponential re-visitation on diamond-shaped DAGs)
**Scan date:** 2026-03-29
**Scope:** `java/org/apache/catalina/`, `java/org/apache/tomcat/util/descriptor/web/`

## Methods Checked

| Method | Location | Guard | Result |
|--------|----------|-------|--------|
| `WebXml` fragment ordering (`before`/`after`) | `WebXml.java` | Servlet-spec ordering uses constraint propagation, not recursive graph traversal | CLEAN |
| `ContextConfig` lifecycle | `ContextConfig.java` | No recursive dependency cycle detection found | CLEAN |
| Connector/Mapper initialization | Previously scanned | No recursive traversal | CLEAN (see `tomcat-CLEAN-connectorandmapper.md`) |

## Conclusion

Tomcat's web-fragment ordering algorithm (servlet specification section 8.2.2) propagates
`before`/`after` constraints iteratively rather than recursively traversing a dependency graph.
No diamond-recursion pattern was found.
