GitHub Advisoryadvisory · crates.io
GHSA-x8jh-xj3x-gx3c `fast-float` has multiple soundness issues
LOW
Official page ↗
- Ecosystem
- crates.io
- Packages
- fast-float
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- Reviewed
- 2024-11-12
Affected packages
• crates.io fast-float: <= 0.2.0 (no fix yet)
Description
`fast-float` contains multiple soundness issues:
1. Undefined behavior when checking input length, which has been merged but no package pubished.
1. Many functions marked as safe with non-local safety guarantees
The library is also unmaintained.
Alternatives
For quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been merged into libcore. When requiring direct parsing from bytes and/or partial parsers, the `fast-float2` fork of `fast-float` containing these security patches and reduces overall usage of unsafe.