# UNDF: UNDF-2026-000000562
# uvicorn — CWE-407 Scan: CLEAN

**Date:** 2026-03-27
**Scope:** Full Python codebase (`uvicorn/`)

## Findings

No CWE-407 defects confirmed.

### Patterns examined

| Location | Pattern | Verdict |
|----------|---------|---------|
| `uvicorn/middleware/proxy_headers.py:_TrustedHosts` | trusted host lookup | CLEAN — uses `set[ipaddress.IPv4Address]`, `set[ipaddress.IPv6Address]`, and `set[str]` for O(1) membership |
| `uvicorn/protocols/http/httptools_impl.py:479` | `CLOSE_HEADER in headers` (list) | NOT O(n²) — single linear scan once per response, not in an outer loop |
| `uvicorn/protocols/http/h11_impl.py:476` | `CLOSE_HEADER in headers` (list) | NOT O(n²) — same as above |
| `uvicorn/protocols/http/httptools_impl.py:145` | `for name, value in self.headers` | CLEAN — single-pass, no inner membership scan |
| `uvicorn/protocols/websockets/` | WebSocket protocol handling | CLEAN — no nested loops with membership tests |

## Conclusion

Uvicorn correctly uses sets for trusted-host membership tests and performs
only single-pass header iterations on hot paths.
