java-topology/defects/pgbouncer/CLEAN.md

PgBouncer — CLEAN (CWE-407)

Scanned 2026-03-30.

PgBouncer uses efficient data structures throughout:

• User lookup: AA-tree (aatree_search) — O(log N)
• Prepared statements: uthash — O(1)
• Session variable cache: uthash — O(1)
• HBA name sets: cbtree (crit-bit tree) for >10 entries — O(log N)
• Database lookup: find_database() is linear scan of database_list, but databases are configuration-bounded (typically <100), not attacker-controlled.

No CWE-407 defect found.