HSEC-2026-0011
Superlinear encoding of numbers with large coefficients
HSEC-2026-0011 is a vulnerability with no CVSS score yet in scientific, published November 3, 2026. No source lists public exploit code. Fixed in scientific 0.3.9.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.9.0scientific
Description
Superlinear encoding of numbers with large coefficients
Encoding (pretty-printing) a Scientific number whose coefficient has many
digits took time quadratic in the number of digits: the decimal digits were
extracted by repeatedly dividing the whole coefficient by 10, once per digit.
The Show instance, Data.Text.Lazy.Builder.Scientific and
Data.ByteString.Builder.Scientific — which aeson uses to encode JSON
numbers — all share this code path. A number with one million digits took
about a minute to show, and about a tenth of a second after the fix.
This is a denial-of-service risk for applications that decode numbers from an
untrusted source and encode them again, e.g. JSON proxies, loggers or API
gateways built on aeson.
Resolution
scientific-0.3.9.0 reimplemented normalize and toDecimalDigits (the
digit-extraction primitive) to be practically linear in the coefficient size.
Note that scientific-0.3.9.0 introduced a regression of its own; see
HSEC-2026-0012. Upgrade
directly to scientific-0.3.10.0 or later, which fixes both issues.
Credits
Reported by Andrzej Rybczak (@arybczak); fixed by Oleg Grenrus (@phadej).
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scientificHackage | before 0.3.9.0, plus listed versions 0.0.0.00.0.0.10.0.0.20.1.0.00.1.0.1 Show 45 moreShow less0.2.0.00.2.0.10.2.0.20.3.0.00.3.0.10.3.0.20.3.1.00.3.2.00.3.2.10.3.2.20.3.3.00.3.3.10.3.3.20.3.3.30.3.3.40.3.3.50.3.3.60.3.3.70.3.3.80.3.4.00.3.4.10.3.4.100.3.4.110.3.4.120.3.4.130.3.4.140.3.4.150.3.4.20.3.4.30.3.4.40.3.4.50.3.4.60.3.4.70.3.4.80.3.4.90.3.5.00.3.5.10.3.5.20.3.5.30.3.6.00.3.6.10.3.6.20.3.7.00.3.8.00.3.8.1 | 0.3.9.0 |
What each source reports
OSVNo score
Superlinear encoding of numbers with large coefficients
Superlinear encoding of numbers with large coefficients
Encoding (pretty-printing) a Scientific number whose coefficient has many
digits took time quadratic in the number of digits: the decimal digits were
extracted by repeatedly dividing the whole coefficient by 10, once per digit.
The Show instance, Data.Text.Lazy.Builder.Scientific and
Data.ByteString.Builder.Scientific — which aeson uses to encode JSON
numbers — all share this code path. A number with one million digits took
about a minute to show, and about a tenth of a second after the fix.
This is a denial-of-service risk for applications that decode numbers from an
untrusted source and encode them again, e.g. JSON proxies, loggers or API
gateways built on aeson.
Resolution
scientific-0.3.9.0 reimplemented normalize and toDecimalDigits (the
digit-extraction primitive) to be practically linear in the coefficient size.
Note that scientific-0.3.9.0 introduced a regression of its own; see
HSEC-2026-0012. Upgrade
directly to scientific-0.3.10.0 or later, which fixes both issues.
Credits
Reported by Andrzej Rybczak (@arybczak); fixed by Oleg Grenrus (@phadej).
- Record
HSEC-2026-0011- Updated
- 2026-11-03
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.