--- a/subprojects/gstreamer/plugins/elements/gstinputselector.c
+++ b/subprojects/gstreamer/plugins/elements/gstinputselector.c
@@ -1806,7 +1806,8 @@ gst_input_selector_event (GstPad * pad, GstObject * parent, GstEvent * event)
   gboolean result = FALSE;
   GstIterator *iter;
   gboolean done = FALSE;
   GValue item = { 0, };
   GstPad *eventpad;
-  GList *pushed_pads = NULL;
+  /* CWE-407 fix: replace O(N) g_list_find seen-list with O(1) hash set */
+  GHashTable *pushed_pads_set = g_hash_table_new (g_direct_hash, g_direct_equal);

   sel = GST_INPUT_SELECTOR (parent);
   iter = gst_element_iterate_sink_pads (GST_ELEMENT_CAST (sel));
@@ -1826,7 +1827,7 @@ gst_input_selector_event (GstPad * pad, GstObject * parent, GstEvent * event)
     gst_event_ref (event);
     result |= gst_pad_push_event (eventpad, event);
-    pushed_pads = g_list_append (pushed_pads, eventpad);
+    g_hash_table_add (pushed_pads_set, eventpad);
     gst_object_unref (eventpad);
   } else {
     GST_INPUT_SELECTOR_UNLOCK (sel);
@@ -1838,19 +1839,19 @@ gst_input_selector_event (GstPad * pad, GstObject * parent, GstEvent * event)
         eventpad = g_value_get_object (&item);

-        /* if already pushed, skip */
-        if (g_list_find (pushed_pads, eventpad)) {
+        /* CWE-407 fix: O(1) hash lookup replaces O(N) g_list_find scan */
+        if (g_hash_table_contains (pushed_pads_set, eventpad)) {
           g_value_reset (&item);
           break;
         }

         gst_event_ref (event);
         result |= gst_pad_push_event (eventpad, event);
-        pushed_pads = g_list_append (pushed_pads, eventpad);
+        g_hash_table_add (pushed_pads_set, eventpad);

         g_value_reset (&item);
         break;
@@ -1870,7 +1871,7 @@ gst_input_selector_event (GstPad * pad, GstObject * parent, GstEvent * event)
   g_value_unset (&item);
   gst_iterator_free (iter);
-  g_list_free (pushed_pads);
+  g_hash_table_destroy (pushed_pads_set);

   gst_event_unref (event);
   return result;