# CLEAN — Apache Commons Lang

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Findings

- `ClassUtils.getAllInterfaces()` — CLEAN: uses `LinkedHashSet` with `if (interfacesFound.add(i))` guard; O(N+E) correct
- `ClassUtils.getAllSuperclasses()` — CLEAN: simple linear superclass chain, no diamond issue
- `TypeUtils.getClosestParentType()` / mutual recursion with `isAssignable()` — CLEAN: each recursive call reduces `cls` to ONE closest parent type; linear O(depth) not O(2^D)
- `TypeUtils.determineTypeArguments()` `typeVarList.contains()` — N is bounded by generic arity (typically 1–3); negligible
- `InheritanceUtils.distance()` — CLEAN: simple linear recursion
- `AnnotationUtils` — CLEAN: no hierarchy traversal

**Result: No actionable CWE-407 defects.**