# CLEAN — Undertow

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Findings

- AllowedContentEncodings linear scan — N is bounded by number of content encodings (typically 2-5); not actionable
- SingleSignOnAuthenticationMechanism — CLEAN: guarded with `seenSessionManagers.add(manager)` return check
- Predicate parser, handler chains — CLEAN: HashMap-based dispatch, no linear scans in hot paths

**Result: No actionable CWE-407 defects.**