Go compiler — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in the Go compiler's type inference engine. tpWalker.isParameterized() uses slices.Index(tparams) — an O(n) scan — for every *TypeParam encountered during type walking, causing O(n²) total cost during generic type inference. Patch ready for upstream review.

The Defects

go-0001 (PATCHED — HIGH): src/cmd/compile/internal/types2/infer.go

// tpWalker.isParameterized() — called per *TypeParam per type walk:
func (w *tpWalker) isParameterized(typ Type) bool {
    // ...
    case *TypeParam:
        return slices.Index(w.tparams, t) >= 0  // O(n) scan per TypeParam
    // ...
}
// O(n²) total over all TypeParams in generic type inference

slices.Index(w.tparams, t) performs O(n) linear scan over all type parameters for every *TypeParam node visited during type walking. For n type parameters: O(n²) total. Measured ratio: 200×.

Complexity Proof

For n=200 type parameters in a generic function/type:

isParameterized() called n times
Each call: O(n) slices.Index scan
Total: O(n²) = 40,000 comparisons
Fixed: map[*TypeParam]bool → O(n) total
200× measured ratio.

Impact

All Go programs using generics — go build and go test for any package with generic functions or types. Type inference runs at compile time for every generic instantiation. Programs with highly parameterized generic types (many type parameters, deeply nested generics) hit worst case on every compilation. The Go compiler is used by every Go developer; generic-heavy code (container packages, algorithm packages, type-safe ORMs) is increasingly common since Go 1.18.

The Fix

Replace slices.Index scan with a map[*TypeParam]bool pre-built from w.tparams:

// Before
return slices.Index(w.tparams, t) >= 0  // O(n) scan per TypeParam

// After
// CWE-407 fix: map[*TypeParam]bool for O(1) lookup instead of O(n) slices.Index scan.
_, ok := w.tparamsSet[t]
return ok

Build w.tparamsSet once when w.tparams is assigned.

Patch

defects/go/patch/go-0001-infer-tpwalker-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your type inference and generics test suite.
Assess CVE eligibility — fires during compilation of every generic-heavy package.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape