# UNDF: UNDF-2026-000000424
# hypercorn — CWE-407 Scan: CLEAN

**Date:** 2026-03-27
**Scope:** Full Python codebase (`src/hypercorn/`)

## Findings

No CWE-407 defects confirmed.

### Patterns examined

| Location | Pattern | Verdict |
|----------|---------|---------|
| `hypercorn/utils.py:filter_pseudo_headers` | single-pass over headers list | CLEAN — O(H), no inner scan |
| `hypercorn/utils.py:build_and_validate_headers` | single-pass over headers list | CLEAN — O(H), no inner scan |
| `hypercorn/protocol/http_stream.py:160,206,232` | `for name, value in scope["headers"]` with `break` | CLEAN — O(H) early-exit scans, not nested |
| `hypercorn/protocol/h2.py` | HTTP/2 stream management via `dict[int, stream]` | CLEAN — dict-keyed by stream_id, O(1) lookup |
| `hypercorn/middleware/dispatcher.py` | `for path, app in self.mounts.items()` | CLEAN — mount table is small and bounded |
| `hypercorn/config.py:response_headers` | `for alt_svc_header in self.alt_svc_headers` | CLEAN — alt_svc_headers bounded (1-2 entries typical) |

## Conclusion

Hypercorn uses single-pass header iterations throughout and relies on dicts
for stream management. No quadratic patterns found.