# CLEAN — Protocol Buffers (Java)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Scope
Java library: java/core/src/main and java/util/src/main — Descriptors, DynamicMessage,
MessageLiteToString, JsonFormat, SchemaUtil, DescriptorMessageInfoFactory.

## Findings

### MessageLiteToString — setters.contains()
`setters` is `Set<String> setters = new HashSet<>()`. O(1). Clean.

### JsonFormat — includingDefaultValueFields.contains()
`includingDefaultValueFields` is `Set<FieldDescriptor>`. O(1). Clean.

### DescriptorMessageInfoFactory — specialFieldNames.contains()
`specialFieldNames` is a static `Set<String>`. O(1). Clean.

## Result
**CLEAN. No actionable CWE-407 defects found in Protocol Buffers Java library.**