java-topology/defects/memcached/patch/memcached-CLEAN.md

UNDF: UNDF-2026-000000169

Memcached CWE-407 Scan — CLEAN

Scan date: 2026-03-28

Findings

• assoc.c:70 assoc_find() — hash bucket walk O(chain length). Hash pre-computed by caller, averages O(1). Not called in nested loops.
• items.c eviction loop — LRU tail walk bounded at tries=5. Not quadratic.
• crawler.c — LRU crawler calls assoc_find() once per item with pre-computed hash.
• thread.c — connection queue uses STAILQ push/pop, no membership scan.

Conclusion

Memcached uses pre-hashed keys throughout. No CWE-407 defects found.