# UNDF: UNDF-2026-000000057
diff --git a/src/EFCore/Metadata/Internal/PropertyExtensions.cs b/src/EFCore/Metadata/Internal/PropertyExtensions.cs
index xxxxxxx..xxxxxxx 100644
--- a/src/EFCore/Metadata/Internal/PropertyExtensions.cs
+++ b/src/EFCore/Metadata/Internal/PropertyExtensions.cs
@@ -50,20 +50,23 @@ namespace Microsoft.EntityFrameworkCore.Metadata.Internal;
     public static IProperty? FindGenerationProperty(this IProperty property)
     {
-        var traversalList = new List<IProperty> { property };
+        // efcore-0001 fix: use HashSet for O(1) visited check in BFS traversal.
+        // Previously List<IProperty>: traversalList.Contains() is O(N) per call,
+        // called inside a while loop over traversalList × foreignKey.Properties loop,
+        // giving O(D²) total cost where D = FK chain depth.
+        // HashSet<IProperty> reduces membership check to O(1), fixing CWE-407.
+        var traversalList = new List<IProperty> { property };
+        var traversalSet = new HashSet<IProperty>(ReferenceEqualityComparer.Instance) { property };

         var index = 0;
         while (index < traversalList.Count)
         {
             var currentProperty = traversalList[index];

             if (currentProperty.RequiresValueGenerator())
             {
                 return currentProperty;
             }

             foreach (var foreignKey in currentProperty.GetContainingForeignKeys())
             {
                 for (var propertyIndex = 0; propertyIndex < foreignKey.Properties.Count; propertyIndex++)
                 {
                     if (currentProperty == foreignKey.Properties[propertyIndex])
                     {
                         var nextProperty = foreignKey.PrincipalKey.Properties[propertyIndex];
-                        if (!traversalList.Contains(nextProperty))
+                        if (traversalSet.Add(nextProperty))
                         {
                             traversalList.Add(nextProperty);
                         }
                     }
                 }
             }

             index++;
         }

         return null;
     }