# UNDF: UNDF-2026-000000469
# Netty — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-28
**Repo:** https://github.com/netty/netty (depth=1)
**Modules scanned:** transport, codec, codec-http, codec-http2, codec-classes-quic, codec-mqtt, codec-smtp, handler (SSL/TLS), resolver-dns, common

## Summary

No qualifying CWE-407 defects found in Netty.

## Candidates reviewed and rejected

| Location | Pattern | Reason disqualified |
|---|---|---|
| `handler/ssl/JdkBaseApplicationProtocolNegotiator.java:146` | `for (p : supportedProtocols) { protocols.contains(p) }` | Both collections bounded to ≤4 ALPN protocol strings; trivial constant |
| `handler/ssl/SupportedCipherSuiteFilter.java:51` | `for (c : ciphers) { supportedCiphers.contains(c) }` | `supportedCiphers` is `Set<String>` — O(1) lookup |
| `resolver-dns/DnsNameResolverBuilder.java:568` | `for (f : searchDomains) { list.contains(f) }` | Search domain dedup; bounded ≤6 by RFC 1535 |
| `resolver-dns/DnsResolveContext.java:914` | `finalResult.contains(converted)` | Intentional ArrayList choice with code comment explaining the tradeoff; duplicates rare in practice |
| `codec-classes-quic/QuicCodecDispatcher.java:91` | `contextList.indexOf(ctxDispatcher)` | One-shot call after `add`, not in a loop |

## Conclusion

Netty uses `Set<String>` for all cipher-suite and cipher-blacklist lookups, `HashMap`/`CharSequenceMap` for header tables, and purpose-built hash tables for HPACK. No O(N²) membership patterns in hot paths.