java-topology/defects/gunicorn/patch/gunicorn-CLEAN.md

UNDF: UNDF-2026-000000412

gunicorn — CWE-407 Scan: CLEAN

Date: 2026-03-27 Scope: Full Python codebase (gunicorn/)

Findings

No CWE-407 defects confirmed.

Patterns examined

Location	Pattern	Verdict
gunicorn/util.py:hop_headers	header.lower().strip() in hop_headers	CLEAN — hop_headers is a frozenset (O(1))
gunicorn/http/message.py:parse_headers	name in forwarder_headers inside header loop	BOUNDED — forwarder_headers is a list but default length is 2 ("SCRIPT_NAME,PATH_INFO"); not exploitable
gunicorn/http/message.py:secure_scheme_headers	name in secure_scheme_headers inside header loop	CLEAN — secure_scheme_headers is a dict (O(1))
gunicorn/arbiter.py:WORKERS	worker management	CLEAN — WORKERS is a dict keyed by PID
gunicorn/http2/stream.py	HTTP/2 stream state	CLEAN — simple state machine, no list-based membership
gunicorn/http2/connection.py	headers list iteration	CLEAN — single-pass iteration, no inner scan
gunicorn/config.py	config validation	CLEAN — all O(1) structures or bounded lists

Conclusion

Gunicorn uses appropriate data structures throughout hot paths. The forwarder_headers list is user-controlled and defaults to 2 elements, making any quadratic component negligible in practice.