# UNDF: UNDF-2026-000000412
# gunicorn — CWE-407 Scan: CLEAN

**Date:** 2026-03-27
**Scope:** Full Python codebase (`gunicorn/`)

## Findings

No CWE-407 defects confirmed.

### Patterns examined

| Location | Pattern | Verdict |
|----------|---------|---------|
| `gunicorn/util.py:hop_headers` | `header.lower().strip() in hop_headers` | CLEAN — `hop_headers` is a `frozenset` (O(1)) |
| `gunicorn/http/message.py:parse_headers` | `name in forwarder_headers` inside header loop | BOUNDED — `forwarder_headers` is a list but default length is 2 ("SCRIPT_NAME,PATH_INFO"); not exploitable |
| `gunicorn/http/message.py:secure_scheme_headers` | `name in secure_scheme_headers` inside header loop | CLEAN — `secure_scheme_headers` is a `dict` (O(1)) |
| `gunicorn/arbiter.py:WORKERS` | worker management | CLEAN — `WORKERS` is a `dict` keyed by PID |
| `gunicorn/http2/stream.py` | HTTP/2 stream state | CLEAN — simple state machine, no list-based membership |
| `gunicorn/http2/connection.py` | `headers` list iteration | CLEAN — single-pass iteration, no inner scan |
| `gunicorn/config.py` | config validation | CLEAN — all O(1) structures or bounded lists |

## Conclusion

Gunicorn uses appropriate data structures throughout hot paths. The
`forwarder_headers` list is user-controlled and defaults to 2 elements,
making any quadratic component negligible in practice.
