# UNDF: UNDF-2026-000000169
# Memcached CWE-407 Scan — CLEAN

**Scan date:** 2026-03-28

## Findings

- `assoc.c:70` `assoc_find()` — hash bucket walk O(chain length). Hash pre-computed
  by caller, averages O(1). Not called in nested loops.
- `items.c` eviction loop — LRU tail walk bounded at `tries=5`. Not quadratic.
- `crawler.c` — LRU crawler calls `assoc_find()` once per item with pre-computed hash.
- `thread.c` — connection queue uses `STAILQ` push/pop, no membership scan.

## Conclusion

Memcached uses pre-hashed keys throughout. No CWE-407 defects found.