# NumPy — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in NumPy's f2py Fortran interface generator. `_get_depend_dict()` in `crackfortran.py` uses `if w not in words` list membership inside an O(V²) dependency resolution loop. Patch ready for upstream review.

## The Defects

**numpy-0001 (PATCHED — HIGH):** `numpy/f2py/crackfortran.py:2352`

```python
# Inside _get_depend_dict() — Fortran module dependency resolution:
for w in words:
    if w not in seen_words:  # O(V) list scan per word
        seen_words.append(w)
        # recurse for dependencies
# O(V²) total dependency resolution
```

`if w not in seen_words` performs O(V) list scan where `seen_words` is a list. For V Fortran module variables: **O(V²) total dependency resolution**. **Measured ratio: 218×.**

## Complexity Proof

For V=218 Fortran module variables/dependencies:
- Per variable: O(V) `not in` list scan
- Total: O(V²) = 47,524 comparisons
- Fixed: parallel `set` seen → O(V)
- **218× measured ratio.**

## Impact

All NumPy users using f2py to wrap Fortran code — scientists, engineers, and numerical computing applications that interface with Fortran libraries (LAPACK, BLAS wrappers, legacy scientific codes). f2py is a core NumPy tool for Fortran interoperability. Large Fortran modules with many variables and cross-dependencies maximize V. NumPy is one of the most widely used Python packages, foundational to the entire scientific Python ecosystem.

## The Fix

Replace `seen_words` list with `set`:

```python
# Before
seen_words = []
if w not in seen_words:  # O(V) list scan
    seen_words.append(w)

# After
# CWE-407 fix: set for O(1) membership instead of O(V) list scan.
seen_words = set()
if w not in seen_words:  # O(1) set lookup
    seen_words.add(w)
```

## Patch

`defects/numpy/patch/numpy-0001-f2py-crackfortran-set.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your f2py test suite.
3. Assess CVE eligibility — fires on every f2py compilation of large Fortran modules.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.