Reliance on Undefined, Unspecified, or Implementation-Defined Behavior Affecting fast-float package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-FASTFLOAT-8380999
- published14 Nov 2024
- disclosed12 Nov 2024
- creditAlexander Huszagh
Introduced: 12 Nov 2024
CVE NOT AVAILABLE CWE-758 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
There is no fixed version for fast-float.
Overview
fast-float is a crate that provides a super-fast decimal number parser from strings into floats.
Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified, or Implementation-Defined Behavior when checking input length and due to functions marked as safe with non-local safety guarantees.
Note:
There is a maintained fork of this package, containing a fix for this vulnerability: fast-float2