# httpx: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/encode/httpx (depth=1)

## Scan scope

- `httpx/` — 23 Python files
- Focus: header dedup, cookie jar membership, redirect chain dedup, transport pool membership, URL param dedup
- Keywords: `in list`, `.index(`, nested for loops

## Findings

No CWE-407 defects found.

- `Headers.__contains__` (line 346-348) creates a list and does linear scan — O(H) per call.
  `Headers.update()` calls `if key in self` in a loop — technically O(K*H), but HTTP headers
  are bounded (typically < 50) and this is a standard design for case-insensitive multidict.
- `Headers.__setitem__` and `__delitem__` also do linear scans over the internal list,
  but again bounded by header count.
- Redirect chain bounded by `max_redirects` (default 20)
- Cookie handling delegates to stdlib `CookieJar`
- `QueryParams` backed by dict — O(1) lookup

## Verdict

CLEAN — all linear scans are on bounded collections (HTTP headers). No unbounded O(N^2) patterns.