base · fromIntegral: conversion error
Affects baseSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 4.15.1.0
Data as of 13 Nov 2026, 18:41 UTC
What to do
Upgrade base to 4.15.1.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagebase | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to base package version 4.15.1.0 or later where the issue is fixed. Apply the patches linked in the official GitLab merge requests. No other mitigation is necessary as the fix addresses the root cause.
Description
The 'fromIntegral' function in the 'base' package versions >=4.15.0.0 and <4.15.1.0 may produce conversion errors under optimization flags -O1 or -O2. These errors occur when converting negative Int values to Natural without throwing an underflow error, and when converting large Integer values greater than 2^64 to Natural, causing overflow. While primarily causing availability and data integrity issues, these errors can potentially lead to more severe security flaws such as buffer overflows in certain contexts. A fix is available in version 4.15.1.0.