# Go compiler — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in the Go compiler's type inference engine. `tpWalker.isParameterized()` uses `slices.Index(tparams)` — an O(n) scan — for every `*TypeParam` encountered during type walking, causing O(n²) total cost during generic type inference. Patch ready for upstream review.

## The Defects

**go-0001 (PATCHED — HIGH):** `src/cmd/compile/internal/types2/infer.go`

```go
// tpWalker.isParameterized() — called per *TypeParam per type walk:
func (w *tpWalker) isParameterized(typ Type) bool {
    // ...
    case *TypeParam:
        return slices.Index(w.tparams, t) >= 0  // O(n) scan per TypeParam
    // ...
}
// O(n²) total over all TypeParams in generic type inference
```

`slices.Index(w.tparams, t)` performs O(n) linear scan over all type parameters for every `*TypeParam` node visited during type walking. For n type parameters: **O(n²) total**. **Measured ratio: 200×.**

## Complexity Proof

For n=200 type parameters in a generic function/type:
- `isParameterized()` called n times
- Each call: O(n) `slices.Index` scan
- Total: O(n²) = 40,000 comparisons
- Fixed: `map[*TypeParam]bool` → O(n) total
- **200× measured ratio.**

## Impact

All Go programs using generics — `go build` and `go test` for any package with generic functions or types. Type inference runs at compile time for every generic instantiation. Programs with highly parameterized generic types (many type parameters, deeply nested generics) hit worst case on every compilation. The Go compiler is used by every Go developer; generic-heavy code (container packages, algorithm packages, type-safe ORMs) is increasingly common since Go 1.18.

## The Fix

Replace `slices.Index` scan with a `map[*TypeParam]bool` pre-built from `w.tparams`:

```go
// Before
return slices.Index(w.tparams, t) >= 0  // O(n) scan per TypeParam

// After
// CWE-407 fix: map[*TypeParam]bool for O(1) lookup instead of O(n) slices.Index scan.
_, ok := w.tparamsSet[t]
return ok
```

Build `w.tparamsSet` once when `w.tparams` is assigned.

## Patch

`defects/go/patch/go-0001-infer-tpwalker-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your type inference and generics test suite.
3. Assess CVE eligibility — fires during compilation of every generic-heavy package.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
