# UNDF: UNDF-2026-000000007
--- a/apps/app_meetme.c
+++ b/apps/app_meetme.c
@@ -944,7 +944,17 @@ static char *complete_meetmecmd_mute_kick(const char *line, const char *word, in

-static AST_LIST_HEAD_STATIC(confs, ast_conference);
+/*
+ * CWE-407 fix: replace O(n) linked-list traversal with O(1) ao2_container
+ * hash lookup keyed on confno string.
+ */
+static struct ao2_container *confs_container;
+
+static int conf_hash_fn(const void *obj, const int flags)
+{
+	const struct ast_conference *cnf = obj;
+	return ast_str_hash(cnf->confno);
+}
+
+static int conf_cmp_fn(void *obj, void *arg, int flags)
+{
+	const struct ast_conference *left = obj;
+	const struct ast_conference *right = arg;
+	return strcmp(left->confno, right->confno) ? 0 : CMP_MATCH | CMP_STOP;
+}

@@ -1482,7 +1482,7 @@ static struct ast_conference *build_conf(const char *confno, ...)
-	AST_LIST_LOCK(&confs);
-	AST_LIST_TRAVERSE(&confs, cnf, list) {
-		if (!strcmp(confno, cnf->confno))
-			break;
-	}
-	if (cnf || (!make && !dynamic) || !cap_slin)
-		goto cnfout;
+	struct ast_conference lookup = {};
+	ast_copy_string(lookup.confno, confno, sizeof(lookup.confno));
+	ao2_lock(confs_container);
+	cnf = ao2_find(confs_container, &lookup, OBJ_POINTER);
+	if (cnf || (!make && !dynamic) || !cap_slin) {
+		ao2_unlock(confs_container);
+		goto cnfout;
+	}

 	/* ... create new cnf ... */
-	AST_LIST_INSERT_HEAD(&confs, cnf, list);
+	ao2_link(confs_container, cnf);
+	ao2_unlock(confs_container);

@@ -4308,11 +4308,8 @@ static struct ast_conference *find_conf(...)
-	AST_LIST_LOCK(&confs);
-	AST_LIST_TRAVERSE(&confs, cnf, list) {
-		ast_debug(3, "Does conf %s match %s?\n", confno, cnf->confno);
-		if (!strcmp(confno, cnf->confno))
-			break;
-	}
-	if (cnf) {
-		cnf->refcount += refcount;
-	}
-	AST_LIST_UNLOCK(&confs);
+	struct ast_conference lookup = {};
+	ast_copy_string(lookup.confno, confno, sizeof(lookup.confno));
+	ao2_lock(confs_container);
+	cnf = ao2_find(confs_container, &lookup, OBJ_POINTER);
+	if (cnf) cnf->refcount += refcount;
+	ao2_unlock(confs_container);

@@ -load_module,0 +load_module,5 @@
+	confs_container = ao2_container_alloc_hash(
+		AO2_ALLOC_OPT_LOCK_MUTEX, 0,
+		131, conf_hash_fn, NULL, conf_cmp_fn);
+	if (!confs_container)
+		return AST_MODULE_LOAD_FAILURE;