# UNDF: UNDF-2026-000000367
# consul-0001: ExcludeBasedOnChecks — O(checks × ignoreIDs)

## CWE
CWE-407: Inefficient Algorithmic Complexity

## Severity
MEDIUM

## Location
`agent/structs/structs.go:2244-2252`

## Description
`ExcludeBasedOnChecks` iterates over all checks for a service node and for
each calls `slices.Contains(opts.IgnoreCheckIDs, check.CheckID)` — a linear
scan over the ignore list.

```go
for _, check := range csn.Checks {
    if slices.Contains(opts.IgnoreCheckIDs, check.CheckID) {   // O(|IgnoreCheckIDs|)
        continue
    }
    ...
}
```

This function is called in health query hot paths (service discovery). With
C checks per node and I ignore IDs: O(C × I) per node, compounded over all
nodes returned in a health query.

## Fix
Build a `map[types.CheckID]struct{}` from `opts.IgnoreCheckIDs` once
(either in the caller or at the start of the function).

## Speedup
~Ix where I = len(IgnoreCheckIDs).
