# UNDF: UNDF-2026-000000343
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -24,6 +24,7 @@
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
@@ -948,11 +949,12 @@
-        // This would be done better with a Set but ACL hashcode/equals do not
-        // allow for null values
-        final ArrayList<ACL> retval = new ArrayList<>(acls.size());
+        // CWE-407 fix: parallel HashSet for O(1) membership test instead of O(N) ArrayList.contains
+        final List<ACL> retval = new ArrayList<>(acls.size());
+        final Set<ACL> seen = new HashSet<>(acls.size());
         for (final ACL acl : acls) {
-            if (!retval.contains(acl)) {
-                retval.add(acl);
+            if (seen.add(acl)) {
+                retval.add(acl);
             }
         }
         return retval;