--- a/exposed-core/src/main/kotlin/org/jetbrains/exposed/v1/core/SchemaUtilityApi.kt
+++ b/exposed-core/src/main/kotlin/org/jetbrains/exposed/v1/core/SchemaUtilityApi.kt
@@ -77,14 +77,16 @@ abstract class SchemaUtilityApi {
     ): C {
         val isSqlite = currentDialect is SQLiteDialect
         // create columns
-        val existingTableColumns = columns.mapNotNull { column ->
-            val existingColumn = existingColumns.find { column.nameUnquoted().equals(it.name, true) }
+        // CWE-407 fix: pre-build O(1) lookup map instead of O(N) find {} per column
+        val existingByName = existingColumns.associateBy { it.name.lowercase() }
+        val existingTableColumns = columns.mapNotNull { column ->
+            val existingColumn = existingByName[column.nameUnquoted().lowercase()]
             if (existingColumn != null) column to existingColumn else null
         }.toMap()
         val missingTableColumns = columns.filter { it !in existingTableColumns }
+        val missingTableColumnsSet = missingTableColumns.toHashSet()
         missingTableColumns.flatMapTo(destination) { it.ddl }
         if (alterTableAddColumnSupported) {
             // create indexes with new columns
             indices.filter { index ->
-                index.columns.any { missingTableColumns.contains(it) }
+                index.columns.any { missingTableColumnsSet.contains(it) }
             }.forEach { destination.addAll(it.createStatement()) }