# UNDF: UNDF-2026-000000168
--- a/impl/maven-core/src/main/java/org/apache/maven/execution/DefaultMavenExecutionRequest.java
+++ b/impl/maven-core/src/main/java/org/apache/maven/execution/DefaultMavenExecutionRequest.java
@@ -1,6 +1,8 @@
 import java.util.ArrayList;
+import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Set;

 // ... (existing imports unchanged)

@@ -86,7 +88,12 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
-    private List<String> pluginGroups;
+    // CWE-407 fix: replace ArrayList with LinkedHashSet for O(1) membership
+    // tests in addPluginGroup(). addPluginGroups() calls addPluginGroup() once
+    // per group, and each call did ArrayList.contains() — O(G) — giving
+    // O(G²) for G plugin groups added in batch.  LinkedHashSet preserves
+    // insertion order (required for plugin-prefix lookup) and makes every
+    // contains() / add() O(1) amortised.
+    private Set<String> pluginGroups;

@@ -795,8 +802,8 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
     @Override
     public List<String> getPluginGroups() {
         if (pluginGroups == null) {
-            pluginGroups = new ArrayList<>();
+            pluginGroups = new LinkedHashSet<>();
         }
-        return pluginGroups;
+        return new ArrayList<>(pluginGroups);
     }

@@ -806,8 +813,8 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
     public MavenExecutionRequest setPluginGroups(List<String> pluginGroups) {
         if (pluginGroups != null) {
-            this.pluginGroups = new ArrayList<>(pluginGroups);
+            this.pluginGroups = new LinkedHashSet<>(pluginGroups);
         } else {
             this.pluginGroups = null;
         }

@@ -817,7 +824,7 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
     @Override
     public MavenExecutionRequest addPluginGroup(String pluginGroup) {
-        if (!getPluginGroups().contains(pluginGroup)) {
-            getPluginGroups().add(pluginGroup);
-        }
+        // pluginGroups is now a LinkedHashSet: add() is O(1) and a no-op for
+        // duplicates, replacing the previous contains()+add() pair that was
+        // O(N) per call when pluginGroups was an ArrayList.
+        if (pluginGroups == null) pluginGroups = new LinkedHashSet<>();
+        pluginGroups.add(pluginGroup);
         return this;
     }