# UNDF: UNDF-2026-000000020
# Caddy matchers.go + upstreams.go — CWE-407 scan result: CLEAN

## Scan date: 2026-03-27

## Files scanned

| File | Finding |
|------|---------|
| `modules/caddyhttp/matchers.go` | CLEAN — see notes |
| `modules/caddyhttp/reverseproxy/upstreams.go` | CLEAN |

## Notes

**matchers.go `matchHeaders`**: Contains a triple-nested loop O(H×A×V) where
H = header fields in matcher config, A = actual header values per field,
V = allowed values per field.  All three dimensions are practically bounded
to small constants by HTTP header semantics (H ≤ 10, A ≤ 5, V ≤ 5).
This does not produce unbounded O(N²) growth and does not meet the CWE-407
threshold.

**upstreams.go**: SRV/A record loops use map-based O(1) lookups
(`srvs[suAddr]`, `aAaaa[auStr]`).  No nested linear membership tests found.

**Verdict: CLEAN** (beyond caddy-0001 which is already patched)
