# Undertow — Diamond Recursion (CWE-407 O(2^D)) Scan: CLEAN

**Pattern:** Recursive cycle-detection / dependency traversal without a visited set
(exponential re-visitation on diamond-shaped DAGs)
**Scan date:** 2026-03-29
**Scope:** `core/src/main/java/io/undertow/`

## Methods Checked

| Method | Location | Guard | Result |
|--------|----------|-------|--------|
| Handler chain wiring | `core/src/main/java/io/undertow/server/handlers/` | No recursive dependency graph traversal | CLEAN |
| SSL conduit state machine | `SslConduit.java` | State flags, not graph traversal | CLEAN |
| `ChainedHandlerWrapper` | `ChainedHandlerWrapper.java` | Linear list, no graph | CLEAN |

## Conclusion

Undertow uses a handler chain model rather than a dependency graph. No recursive cycle
detection without a visited set was found. Diamond-recursion pattern does not apply.
