# UNDF: UNDF-2026-000000484
# OpenBGPD CWE-407 Scan — CLEAN

**Scan date:** 2026-03-28
**Source:** `usr.sbin/bgpd/` in openbsd-src

## Findings

`rde_community.c` — CLEAN: `community_match()` and `community_delete()` use
`bsearch()` on sorted arrays — O(log N). Wildcard/masked match is a single O(N)
linear scan, not nested.

`rde_filter.c` — CLEAN: `MAX_COMM_MATCH` loop bounded at compile-time constant (3).

`rde_attr.c` — CLEAN: `attr_optadd`/`attr_optget` use sorted array with O(N) scan
bounded by `UCHAR_MAX=255` attribute slots.

Prefix sets use `rde_trie.c` — O(prefix length). AS sets use sorted arrays with
binary search. No O(N²) community/prefix operations found.

## Conclusion

OpenBGPD's community infrastructure is deliberately designed around sorted arrays +
`bsearch` — no CWE-407 defects found.
