From 339f2245ba0ed3ce0d21bed38cd9483c4980f702 Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Sun, 29 Mar 2026 19:34:44 -0400
Subject: [PATCH] ktor/undertow: CLEAN markers (no CWE-407 defects found)

---
 defects/ktor/patch/CLEAN.md     | 11 +++++++++++
 defects/undertow/patch/CLEAN.md | 11 +++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 defects/ktor/patch/CLEAN.md
 create mode 100644 defects/undertow/patch/CLEAN.md

diff --git a/defects/ktor/patch/CLEAN.md b/defects/ktor/patch/CLEAN.md
new file mode 100644
index 000000000..8e3054b33
--- /dev/null
+++ b/defects/ktor/patch/CLEAN.md
@@ -0,0 +1,11 @@
+# CLEAN — Ktor
+
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+
+## Findings
+
+- YamlConfig recursive value traversal — CLEAN: correctly guarded with `!visited.add(value)`
+- JsonSchemaInference Kotlin reflection — CLEAN: proper visited set guards
+- Plugin registration, content negotiation — CLEAN: safe HashMap-based dispatch
+
+**Result: No actionable CWE-407 defects.**
diff --git a/defects/undertow/patch/CLEAN.md b/defects/undertow/patch/CLEAN.md
new file mode 100644
index 000000000..875aefb91
--- /dev/null
+++ b/defects/undertow/patch/CLEAN.md
@@ -0,0 +1,11 @@
+# CLEAN — Undertow
+
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+
+## Findings
+
+- AllowedContentEncodings linear scan — N is bounded by number of content encodings (typically 2-5); not actionable
+- SingleSignOnAuthenticationMechanism — CLEAN: guarded with `seenSessionManagers.add(manager)` return check
+- Predicate parser, handler chains — CLEAN: HashMap-based dispatch, no linear scans in hot paths
+
+**Result: No actionable CWE-407 defects.**