# UNDF: UNDF-2026-000000300
diff --git a/src/build.c b/src/build.c
index abcdef..123456 100644
--- a/src/build.c
+++ b/src/build.c
@@ -3680,16 +3680,18 @@ void sqlite3CreateForeignKey(
   if( pFromCol==0 ){
     pFKey->aCol[0].iFrom = p->nCol-1;
   }else{
     for(i=0; i<nCol; i++){
-      int j;
-      for(j=0; j<p->nCol; j++){
-        if( sqlite3StrICmp(p->aCol[j].zCnName, pFromCol->a[i].zEName)==0 ){
-          pFKey->aCol[i].iFrom = j;
-          break;
-        }
-      }
-      if( j>=p->nCol ){
+      /* CWE-407 fix (sqlite-0003, build.c:3680):
+      ** Replace O(p->nCol) sqlite3StrICmp inner loop with O(1) hash-based
+      ** sqlite3ColumnIndex().  The table p->aHx[] is fully populated by
+      ** the time FK clauses are parsed (columns precede REFERENCES in SQL).
+      */
+      int j = sqlite3ColumnIndex(p, pFromCol->a[i].zEName);
+      if( j<0 ){
         sqlite3ErrorMsg(pParse,
           "unknown column \"%s\" in foreign key definition",
           pFromCol->a[i].zEName);
         goto fk_end;
+      }else{
+        pFKey->aCol[i].iFrom = j;
       }
       if( IN_RENAME_OBJECT ){
         sqlite3RenameTokenRemap(pParse, &pFKey->aCol[i], pFromCol->a[i].zEName);