--- a/synapse/server_notices/resource_limits_server_notices.py
+++ b/synapse/server_notices/resource_limits_server_notices.py
@@ -190,15 +190,15 @@ class ResourceLimitsServerNotices:
             pass

-        referenced_events: List[str] = []
+        referenced_event_ids: List[str] = []
         if pinned_state_event is not None:
-            referenced_events = list(pinned_state_event.content.get("pinned", []))
+            referenced_event_ids = list(pinned_state_event.content.get("pinned", []))

-        events = await self._store.get_events(referenced_events)
+        events = await self._store.get_events(referenced_event_ids)
+        # CWE-407 fix: use a set for O(1) membership and discard instead of O(n) list.remove()
+        referenced_set: set = set(referenced_event_ids)
         for event_id, event in events.items():
             if event.type != EventTypes.Message:
                 continue
             if event.content.get("msgtype") == ServerNoticeMsgType:
                 currently_blocked = True
                 # remove event in case we need to disable blocking later on.
-                if event_id in referenced_events:
-                    referenced_events.remove(event.event_id)
+                referenced_set.discard(event.event_id)

-        return currently_blocked, referenced_events
+        return currently_blocked, list(referenced_set)