# UNDF: UNDF-2026-000000342
--- a/src/RuleMatcher.h
+++ b/src/RuleMatcher.h
@@ -1,4 +1,5 @@
 #pragma once
+#include <unordered_set>

@@ -216,7 +217,7 @@ class RuleEndpointState {
     // The set of rules fully matched.
     // Maintained as a dedup list to avoid double-firing actions.
-    int_list matched_rules; // Rules for which all conditions have matched
+    std::unordered_set<std::intptr_t> matched_rules; // O(1) dedup

--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -48,7 +48,8 @@
 //   - tcp-state always evaluates to true

-static bool is_member_of(const int_list& l, int_list::value_type v) { return std::ranges::find(l, v) != l.end(); }
+static bool is_member_of(const std::unordered_set<std::intptr_t>& s, std::intptr_t v) {
+    return s.count(v) > 0;
+}

@@ -990,7 +991,7 @@ void RuleMatcher::ExecRuleActions(Rule* r, RuleEndpointState* state,
     if ( state->opposite && is_member_of(state->opposite->matched_rules, r->Index()) )
         return;

-    state->matched_rules.push_back(r->Index());
+    state->matched_rules.insert(r->Index());