# CLEAN — tokio

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Findings

- `tokio/src/runtime/scheduler/multi_thread/idle.rs` — `sleepers: Vec<usize>` with `.contains()` in `is_parked()`: N is bounded to the worker thread count (typically 1–32). Called once per work-steal attempt, not in a loop over workers. Not actionable.
- `tokio-util/src/codec/any_delimiter_codec.rs` — `seek_delimiters: Vec<u8>` contains check per byte in buffer: D (delimiter count) is user-configured and typically 1–3. This is O(B×D) but D is constant and tiny. Not actionable.
- All other `contains()` calls use bitflags or range containment. CLEAN.

**Result: No actionable CWE-407 defects.**