java-topology/defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md

UNDF: UNDF-2026-000000020

Caddy matchers.go + upstreams.go — CWE-407 scan result: CLEAN

Scan date: 2026-03-27

Files scanned

File	Finding
modules/caddyhttp/matchers.go	CLEAN — see notes
modules/caddyhttp/reverseproxy/upstreams.go	CLEAN

Notes

matchers.go matchHeaders: Contains a triple-nested loop O(H×A×V) where H = header fields in matcher config, A = actual header values per field, V = allowed values per field. All three dimensions are practically bounded to small constants by HTTP header semantics (H ≤ 10, A ≤ 5, V ≤ 5). This does not produce unbounded O(N²) growth and does not meet the CWE-407 threshold.

upstreams.go: SRV/A record loops use map-based O(1) lookups (srvs[suAddr], aAaaa[auStr]). No nested linear membership tests found.

Verdict: CLEAN (beyond caddy-0001 which is already patched)