# CLEAN — Netty
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Scope
Modules scanned: common, handler (SSL/TLS), codec-http, codec-http2, transport.

## Findings

### handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelector.select()
`for (String p : supportedProtocols)` iterates a `Set<String>` (field declared as
`Set<String> supportedProtocols`) and calls `protocols.contains(p)` on a `List<String>`.
The outer set is O(S) where S = supported ALPN protocol count (typically 1–3); inner
list scan is O(P) where P = negotiated protocol count (also typically 1–3). Total O(S×P)
but bounded to small constants — not actionable.

### handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelectionListener.selected()
`supportedProtocols.contains(protocol)` — single call, not in a loop. Not a CWE-407 issue.

### handler/ssl/SslUtils.addIfSupported()
`supported.contains(n)` — `supported` is declared `Set<String>`. O(1). Clean.

### codec-http2/HttpConversionUtil — HTTP_TO_HTTP2_HEADER_BLACKLIST.contains()
Both `HTTP_TO_HTTP2_HEADER_BLACKLIST` and `connectionBlacklist` are `Set<AsciiString>` — O(1). Clean.

### transport/NioChannelOption — supportedOptions().contains()
Returns `Set<SocketOption<?>>` from the JDK. Clean.

## Result
**CLEAN. No actionable CWE-407 defects found in Netty.**