# CWE-407 Scan — axum (Rust web framework)

**Result: CLEAN**
**Date: 2026-03-30**
**Repo:** https://github.com/tokio-rs/axum (depth=1)

## Scan Summary

Scanned axum (axum, axum-core, axum-extra, axum-macros) for O(N²) list membership
patterns: Vec::contains in loops, visited/seen accumulation, linear dedup.

## Findings

No CWE-407 defects found.

### Key paths examined

| Path | Pattern | Verdict |
|------|---------|---------|
| `routing/method_filter.rs` | `MethodFilter` is a `u16` bitmask — `contains()` is O(1) bitwise AND | CLEAN |
| `extract/ws.rs` | `sec_websocket_protocol: BTreeSet<HeaderValue>` — O(log N) | CLEAN |
| `routing/method_routing.rs:885` | `endpoint_filter.contains(filter)` — bitmask, O(1) | CLEAN |
| `response/sse.rs` | `EventFlags` bitflags — O(1) | CLEAN |
| `axum-extra/routing/typed.rs` | `String::contains('?')` — substring check, not collection | CLEAN |

### Why axum is clean

Axum uses bitmask flags (`MethodFilter`, `EventFlags`) for all method/flag membership
checks — O(1). WebSocket protocol set uses `BTreeSet` (O(log N)). No `Vec::contains`
call in a hot per-request path was found. The framework follows idiomatic Rust
conventions throughout.