# UNDF: UNDF-2026-000000313
--- a/pkg/planner/core/rule/rule_predicate_simplification.go
+++ b/pkg/planner/core/rule/rule_predicate_simplification.go
@@ -228,7 +228,9 @@ func mergeInAndNotEQLists(sctx base.PlanContext, predicates []expression.Express
 	specialCase := false
-	removeValues := make([]int, 0, len(predicates))
+	// CWE-407 fix: use a map so the filter loop below is O(N) instead of
+	// O(N * |removeValues|) from slices.Contains on a growing slice.
+	removeSet := make(map[int]struct{})
 	for i := range predicates {
 		for j := i + 1; j < len(predicates); j++ {
 			ithPredicate := predicates[i]
@@ -248,13 +250,13 @@ func mergeInAndNotEQLists(sctx base.PlanContext, predicates []expression.Express
 			if iCol.Equals(jCol) {
 				if iType == notEqualPredicate && jType == inListPredicate {
 					predicates[j], specialCase = updateInPredicate(sctx, jthPredicate, ithPredicate)
 					if maybeOverOptimized4PlanCache {
 						sctx.GetSessionVars().StmtCtx.SetSkipPlanCache("NE/INList simplification is triggered")
 					}
 					if !specialCase {
-						removeValues = append(removeValues, i)
+						removeSet[i] = struct{}{}
 					}
 				} else if iType == inListPredicate && jType == notEqualPredicate {
 					predicates[i], specialCase = updateInPredicate(sctx, ithPredicate, jthPredicate)
 					if maybeOverOptimized4PlanCache {
 						sctx.GetSessionVars().StmtCtx.SetSkipPlanCache("NE/INList simplification is triggered")
 					}
 					if !specialCase {
-						removeValues = append(removeValues, j)
+						removeSet[j] = struct{}{}
 					}
 				}
 			}
@@ -263,7 +265,7 @@ func mergeInAndNotEQLists(sctx base.PlanContext, predicates []expression.Express
 	newValues := make([]expression.Expression, 0, len(predicates))
 	for i, value := range predicates {
-		if !(slices.Contains(removeValues, i)) {
+		if _, skip := removeSet[i]; !skip {
 			newValues = append(newValues, value)
 		}
 	}