{"id":"GHSA-x8jh-xj3x-gx3c","aliases":["RUSTSEC-2024-0379"],"status":"published","title":"`fast-float` has multiple soundness issues","description":"`fast-float` contains multiple soundness issues:\n\n 1. [Undefined behavior when checking input length](https://github.com/aldanor/fast-float-rust/issues/28), which has been merged but no package [pubished](https://github.com/aldanor/fast-float-rust/issues/35).\n 1. [Many functions marked as safe with non-local safety guarantees](https://github.com/aldanor/fast-float-rust/issues/37)\n\nThe library is also unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. When requiring direct parsing from bytes and/or partial parsers, the [`fast-float2`](https://crates.io/crates/fast-float2) fork of `fast-float` containing these security patches and reduces overall usage of unsafe.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2024-10-31T12:00:00Z","modified":"2026-09-10T03:50:21Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"fast-float","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fast-float","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fast-float","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://github.com/aldanor/fast-float-rust/issues/28","tags":["web","report"]},{"url":"https://github.com/aldanor/fast-float-rust/issues/35","tags":["web","report"]},{"url":"https://github.com/aldanor/fast-float-rust/issues/37","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0379.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x8jh-xj3x-gx3c"},{"url":"https://github.com/aldanor/fast-float-rust","tags":["package"]},{"url":"https://crates.io/crates/fast-float","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-x8jh-xj3x-gx3c","title":"`fast-float` has multiple soundness issues","description":"`fast-float` contains multiple soundness issues:\n\n 1. [Undefined behavior when checking input length](https://github.com/aldanor/fast-float-rust/issues/28), which has been merged but no package [pubished](https://github.com/aldanor/fast-float-rust/issues/35).\n 1. [Many functions marked as safe with non-local safety guarantees](https://github.com/aldanor/fast-float-rust/issues/37)\n\nThe library is also unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. When requiring direct parsing from bytes and/or partial parsers, the [`fast-float2`](https://crates.io/crates/fast-float2) fork of `fast-float` containing these security patches and reduces overall usage of unsafe.\n","status":"published","published":"2024-11-12T20:48:39Z","modified":"2024-11-12T20:48:39Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T14:38:17.357217Z"}],"osv":[{"id":"GHSA-x8jh-xj3x-gx3c","title":"`fast-float` has multiple soundness issues","description":"`fast-float` contains multiple soundness issues:\n\n 1. [Undefined behavior when checking input length](https://github.com/aldanor/fast-float-rust/issues/28), which has been merged but no package [pubished](https://github.com/aldanor/fast-float-rust/issues/35).\n 1. [Many functions marked as safe with non-local safety guarantees](https://github.com/aldanor/fast-float-rust/issues/37)\n\nThe library is also unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. When requiring direct parsing from bytes and/or partial parsers, the [`fast-float2`](https://crates.io/crates/fast-float2) fork of `fast-float` containing these security patches and reduces overall usage of unsafe.\n","status":"published","published":"2024-11-12T20:48:39Z","modified":"2026-09-10T03:50:21.159785115Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"RUSTSEC-2024-0379","title":"Multiple soundness issues","description":"`fast-float` contains multiple soundness issues:\n\n 1. [Undefined behavior when checking input length](https://github.com/aldanor/fast-float-rust/issues/28), which has been merged but no package [pubished](https://github.com/aldanor/fast-float-rust/issues/35).\n 1. [Many functions marked as safe with non-local safety guarantees](https://github.com/aldanor/fast-float-rust/issues/37)\n\nThe library is also unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. When requiring direct parsing from bytes and/or partial parsers, the [`fast-float2`](https://crates.io/crates/fast-float2) fork of `fast-float` containing these security patches and reduces overall usage of unsafe.","status":"published","published":"2024-10-31T12:00:00Z","modified":"2025-10-28T06:29:26.849953Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}