# UNDF: UNDF-2026-000000291
diff --git a/core/src/main/scala/org/apache/spark/deploy/master/Master.scala b/core/src/main/scala/org/apache/spark/deploy/master/Master.scala
--- a/core/src/main/scala/org/apache/spark/deploy/master/Master.scala
+++ b/core/src/main/scala/org/apache/spark/deploy/master/Master.scala
@@ -80,7 +80,8 @@ private[deploy] class Master(
   val apps = new HashSet[ApplicationInfo]

-  private val completedApps = new ArrayBuffer[ApplicationInfo]
+  // CWE-407 fix: HashSet for O(1) contains(); completedApps is only ever tested for membership.
+  private val completedApps = new mutable.HashSet[ApplicationInfo]
   private var nextAppNumber = 0

@@ -1111,7 +1111,7 @@ private[deploy] class Master(
     logInfo(log"Telling app of lost worker: ${MDC(LogKeys.WORKER_ID, worker.id)}")
-    apps.filterNot(completedApps.contains(_)).foreach { app =>
+    apps.filterNot(completedApps).foreach { app =>
       app.driver.send(WorkerRemoved(worker.id, worker.host, message))
     }
   }