# UNDF: UNDF-2026-000000495
# OSRM — CWE-407 Scan Result: CLEAN

## Scan Date
2026-03-27

## Files Scanned
- `src/engine/routing_algorithms/alternative_path_ch.cpp`
- `src/engine/routing_algorithms/alternative_path_mld.cpp`
- `src/engine/routing_algorithms/routing_base_ch.cpp`
- `src/engine/routing_algorithms/routing_base_mld.cpp`
- `src/engine/routing_algorithms/shortest_path.cpp`
- `src/contractor/` (full directory)
- `src/extractor/` (full directory)

## Findings

**No CWE-407 defects found in routing hot paths.**

OSRM explicitly uses appropriate O(1) data structures:

- `alternative_path_ch.cpp` line 638: `std::unordered_set<NodeID> nodes_in_path` — correct O(1) node membership for path sharing calculation
- `alternative_path_mld.cpp` line 292: `std::unordered_set<CellID> cells` — correct O(1) cell membership for path deduplication
- `std::find` uses found: all on small bounded vectors (trip waypoints, class names, via lists) — not in O(N) traversal loops

## Notes

OSRM's CH alternative path solver (`alternative_path_ch.cpp`) demonstrates the correct pattern
that GraphHopper's `AlternativeRouteCH.java` should follow: the shortest path node set is built
as `std::unordered_set<NodeID>` before iterating the search space, giving O(1) membership
tests during the O(E) sweep.