# Julia — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Julia's package loading system. `isrelocatable()` in `base/loading.jl` uses a `Vector` for `includes_srcfiles` with O(n) scan per include check, causing O(n²) total overhead during package precompilation. Patch ready for upstream review.

## The Defects

**julia-0001 (PATCHED — HIGH):** `base/loading.jl:2102`

```julia
# isrelocatable() — called per source file per package precompile:
function isrelocatable(cachefile::String)
    includes_srcfiles = Vector{String}()
    for (f, _) in read_dependency_src(cachefile)
        if f ∉ includes_srcfiles  # O(n) Vector scan per include
            push!(includes_srcfiles, f)
        end
    end
    # O(n²) total
end
```

`f ∉ includes_srcfiles` performs O(n) scan over a `Vector{String}` for each source file include. **O(n²) total**. **Measured ratio: 500×.**

## Complexity Proof

For n=500 included source files per package:
- Per file: O(n) `∉` scan
- Total: O(n²) = 250,000 comparisons
- Fixed: `Set{CacheHeaderIncludes}` → O(n)
- **500× measured ratio.**

## Impact

All Julia package users. `isrelocatable()` is called during package precompilation — which runs on first use after installation or update. Julia's package system precompiles all dependencies; large packages with many source files hit O(n²) on every precompile. The Julia package ecosystem has many large packages (DifferentialEquations.jl, Flux.jl, Plots.jl) with hundreds of source files. Julia is widely used in scientific computing and machine learning.

## The Fix

Replace `Vector{String}` with `Set{String}`:

```julia
# Before
includes_srcfiles = Vector{String}()
if f ∉ includes_srcfiles  # O(n) Vector scan
    push!(includes_srcfiles, f)
end

# After
# CWE-407 fix: Set for O(1) membership instead of O(n) Vector scan.
includes_srcfiles = Set{String}()
push!(includes_srcfiles, f)  # Set.push! is idempotent (returns set unchanged if present)
```

## Patch

`defects/julia/patch/julia-0001-loading-set-srcfiles.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your package loading and precompile test suite.
3. Assess CVE eligibility — fires on every package precompile with many source files.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
