# CLEAN — Apache Thrift (Java)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Scope
Library: lib/java/src — TBinaryProtocol, TCompactProtocol, TJSONProtocol, partial Thrift
comparer, service processor infrastructure.

## Findings

### partial/PartialThriftComparer — s2.contains()
`s2` is cast from parameter `Object o2` and the cast target is `Set<Object>`:
```java
Set<Object> s2 = (Set<Object>) o2;
if (!s2.contains(e1)) { ... }
```
O(1) set membership. Clean.

## Result
**CLEAN. No actionable CWE-407 defects found in Apache Thrift (Java library).**