# UNDF: UNDF-2026-000000055
--- a/Source/Dry/Core/Object.cpp
+++ b/Source/Dry/Core/Object.cpp
@@ -269,12 +269,16 @@ void Object::UnsubscribeFromAllEventsExcept(const PODVector<StringHash>& exceptions, bool onlyUserData)
 {
     EventHandler* handler = eventHandlers_.First();
     EventHandler* previous = nullptr;

+    // FIX dry-0002: was exceptions.Contains() — O(m) per handler — CWE-407
+    // With n handlers and m exceptions: O(n*m) total.
+    // Build a HashSet once at O(m), then each check is O(1) → O(n) total.
+    HashSet<StringHash> exceptionsSet(exceptions.Begin(), exceptions.End());
+
     while (handler)
     {
         EventHandler* next = eventHandlers_.Next(handler);

-        if ((!onlyUserData || handler->GetUserData()) && !exceptions.Contains(handler->GetEventType()))
+        if ((!onlyUserData || handler->GetUserData()) && !exceptionsSet.Contains(handler->GetEventType()))
         {
             if (handler->GetSender())
                 context_->RemoveEventReceiver(this, handler->GetSender(), handler->GetEventType());
             else
                 context_->RemoveEventReceiver(this, handler->GetEventType());

             eventHandlers_.Erase(handler, previous);
         }
         else
             previous = handler;

         handler = next;
     }
 }