diff --git a/lib/sqlalchemy/sql/compiler.py b/lib/sqlalchemy/sql/compiler.py
--- a/lib/sqlalchemy/sql/compiler.py
+++ b/lib/sqlalchemy/sql/compiler.py
@@ -1392,7 +1392,7 @@ class SQLCompiler(Compiled):

     """
-    _values_bindparam: Optional[List[str]] = None
+    _values_bindparam: Optional[Set[str]] = None

     _visited_bindparam: Optional[List[str]] = None

@@ -6156,9 +6156,10 @@ class SQLCompiler(Compiled):
         if self.positional and visited_bindparam is not None:
             counted_bindparam = len(visited_bindparam)
             if self._numeric_binds:
+                # CWE-407 fix: store as Set for O(1) membership test in
+                # _process_numeric().  visited_bindparam is still a List for
+                # counting; convert to set when assigning.
                 if self._values_bindparam is not None:
-                    self._values_bindparam += visited_bindparam
+                    self._values_bindparam.update(visited_bindparam)
                 else:
-                    self._values_bindparam = visited_bindparam
+                    self._values_bindparam = set(visited_bindparam)