Julia — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Julia's package loading system. isrelocatable() in base/loading.jl uses a Vector for includes_srcfiles with O(n) scan per include check, causing O(n²) total overhead during package precompilation. Patch ready for upstream review.

The Defects

julia-0001 (PATCHED — HIGH): base/loading.jl:2102

# isrelocatable() — called per source file per package precompile:
function isrelocatable(cachefile::String)
    includes_srcfiles = Vector{String}()
    for (f, _) in read_dependency_src(cachefile)
        if f ∉ includes_srcfiles  # O(n) Vector scan per include
            push!(includes_srcfiles, f)
        end
    end
    # O(n²) total
end

f ∉ includes_srcfiles performs O(n) scan over a Vector{String} for each source file include. O(n²) total. Measured ratio: 500×.

Complexity Proof

For n=500 included source files per package:

Per file: O(n) ∉ scan
Total: O(n²) = 250,000 comparisons
Fixed: Set{CacheHeaderIncludes} → O(n)
500× measured ratio.

Impact

All Julia package users. isrelocatable() is called during package precompilation — which runs on first use after installation or update. Julia's package system precompiles all dependencies; large packages with many source files hit O(n²) on every precompile. The Julia package ecosystem has many large packages (DifferentialEquations.jl, Flux.jl, Plots.jl) with hundreds of source files. Julia is widely used in scientific computing and machine learning.

The Fix

Replace Vector{String} with Set{String}:

# Before
includes_srcfiles = Vector{String}()
if f ∉ includes_srcfiles  # O(n) Vector scan
    push!(includes_srcfiles, f)
end

# After
# CWE-407 fix: Set for O(1) membership instead of O(n) Vector scan.
includes_srcfiles = Set{String}()
push!(includes_srcfiles, f)  # Set.push! is idempotent (returns set unchanged if present)

Patch

defects/julia/patch/julia-0001-loading-set-srcfiles.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your package loading and precompile test suite.
Assess CVE eligibility — fires on every package precompile with many source files.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape