HSEC-2024-0006 fromIntegral: conversion error
Incorrect integer conversions in Haskell's fromIntegral function can cause data corruption or crashes, potentially leading to buffer overflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2024-0006?
HSEC-2024-0006 is a vulnerability in base, published on 14 Nov 2025.
Official description
fromIntegral: conversion error
fromIntegral may result in coercion errors when used with optimization flags -O1 or -O2
in the following situation:
- Converting negative
InttoNaturaldoes not throw an arithmetic underflow error - Converting large
Integergreater than 2^64 toNaturaloverflow.
For the most part, these errors in and of themselves result only in availability and data integrity issues. However, in some circumstances, they may result in other, more complicated security related flaws, such as buffer overflow conditions.
Which versions are affected by HSEC-2024-0006?
1 open source package ship an affected version, including base.
| Package | Affected | Fixed in |
|---|---|---|
base Hackage | From 4.15.0.0 | 4.15.1.0 |
How do I fix HSEC-2024-0006?
Upgrade base to 4.15.1.0 or later.
Is HSEC-2024-0006 being exploited?
There is no known exploitation of HSEC-2024-0006 in the wild and no public exploit code.