# ZooKeeper CWE-407 Scan Result: CLEAN (beyond zookeeper-0001)

## Scan Date
2026-03-30

## Scope
`zookeeper-server/src/main/java/org/apache/zookeeper/`

## Findings

No new CWE-407 defects found beyond the pre-existing zookeeper-0001.

### Key structures verified

| Structure | Location | Type | Status |
|-----------|----------|------|--------|
| `forwardingFollowers` | `Leader.java:196` | `HashSet<LearnerHandler>` | CLEAN |
| `cnxns` | `ServerCnxnFactory.java:208` | `ConcurrentHashMap`-backed Set | CLEAN |
| `retainedTxnLogs` | `PurgeTxnLog.java:112` | `HashSet<File>` | CLEAN |
| `aclKeyMap` | `ReferenceCountedACLCache.java` | `HashMap<List<ACL>, Long>` | CLEAN |
| `connectingFollowers` | `Leader.java` | passed to `containsQuorum()` via Set | CLEAN |
| `enforceAuthSchemes` | `AuthenticationHelper.java:45` | `ArrayList<String>` — but N≤5 config list, not hot | LOW (N too small) |
| Watch managers | `WatchManager*.java` | `HashSet` / `BitSet` | CLEAN |

### Note on `enforceAuthSchemes`

`enforceAuthSchemes` at `AuthenticationHelper.java:45` is an `ArrayList<String>` with `.contains()`
called in `isCnxnAuthenticated()`. However, this list contains at most 2–3 scheme strings
configured at startup. The O(N) cost per auth check is negligible (N is bounded and tiny). This
does not rise to the level of a CWE-407 defect.