NumPy — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in NumPy's f2py Fortran interface generator. _get_depend_dict() in crackfortran.py uses if w not in words list membership inside an O(V²) dependency resolution loop. Patch ready for upstream review.

The Defects

numpy-0001 (PATCHED — HIGH): numpy/f2py/crackfortran.py:2352

# Inside _get_depend_dict() — Fortran module dependency resolution:
for w in words:
    if w not in seen_words:  # O(V) list scan per word
        seen_words.append(w)
        # recurse for dependencies
# O(V²) total dependency resolution

if w not in seen_words performs O(V) list scan where seen_words is a list. For V Fortran module variables: O(V²) total dependency resolution. Measured ratio: 218×.

Complexity Proof

For V=218 Fortran module variables/dependencies:

Per variable: O(V) not in list scan
Total: O(V²) = 47,524 comparisons
Fixed: parallel set seen → O(V)
218× measured ratio.

Impact

All NumPy users using f2py to wrap Fortran code — scientists, engineers, and numerical computing applications that interface with Fortran libraries (LAPACK, BLAS wrappers, legacy scientific codes). f2py is a core NumPy tool for Fortran interoperability. Large Fortran modules with many variables and cross-dependencies maximize V. NumPy is one of the most widely used Python packages, foundational to the entire scientific Python ecosystem.

The Fix

Replace seen_words list with set:

# Before
seen_words = []
if w not in seen_words:  # O(V) list scan
    seen_words.append(w)

# After
# CWE-407 fix: set for O(1) membership instead of O(V) list scan.
seen_words = set()
if w not in seen_words:  # O(1) set lookup
    seen_words.add(w)

Patch

defects/numpy/patch/numpy-0001-f2py-crackfortran-set.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your f2py test suite.
Assess CVE eligibility — fires on every f2py compilation of large Fortran modules.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape