1.1 KiB
1.1 KiB
UNDF: UNDF-2026-000000562
uvicorn — CWE-407 Scan: CLEAN
Date: 2026-03-27
Scope: Full Python codebase (uvicorn/)
Findings
No CWE-407 defects confirmed.
Patterns examined
| Location | Pattern | Verdict |
|---|---|---|
uvicorn/middleware/proxy_headers.py:_TrustedHosts |
trusted host lookup | CLEAN — uses set[ipaddress.IPv4Address], set[ipaddress.IPv6Address], and set[str] for O(1) membership |
uvicorn/protocols/http/httptools_impl.py:479 |
CLOSE_HEADER in headers (list) |
NOT O(n²) — single linear scan once per response, not in an outer loop |
uvicorn/protocols/http/h11_impl.py:476 |
CLOSE_HEADER in headers (list) |
NOT O(n²) — same as above |
uvicorn/protocols/http/httptools_impl.py:145 |
for name, value in self.headers |
CLEAN — single-pass, no inner membership scan |
uvicorn/protocols/websockets/ |
WebSocket protocol handling | CLEAN — no nested loops with membership tests |
Conclusion
Uvicorn correctly uses sets for trusted-host membership tests and performs only single-pass header iterations on hot paths.