# UNDF: UNDF-2026-000000103
diff --git a/hbase-balancer/src/main/java/org/apache/hadoop/hbase/master/balancer/BaseLoadBalancer.java b/hbase-balancer/src/main/java/org/apache/hadoop/hbase/master/balancer/BaseLoadBalancer.java
--- a/hbase-balancer/src/main/java/org/apache/hadoop/hbase/master/balancer/BaseLoadBalancer.java
+++ b/hbase-balancer/src/main/java/org/apache/hadoop/hbase/master/balancer/BaseLoadBalancer.java
@@ -462,7 +462,8 @@ public abstract class BaseLoadBalancer implements LoadBalancer {
     int numServers = servers.size(); // servers is not null, numServers > 1
     ServerName sn = null;
     final int maxIterations = numServers * 4;
     int iterations = 0;
-    List<ServerName> usedSNs = new ArrayList<>(servers.size());
+    // CWE-407 fix: LinkedHashSet for O(1) contains(); avoids O(S) scan per iteration.
+    Set<ServerName> usedSNs = new LinkedHashSet<>(servers.size());
     Random rand = ThreadLocalRandom.current();
     do {
       int i = rand.nextInt(numServers);