Reliance on Undefined, Unspecified, or Implementation-Defined Behavior Affecting fast-float package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-FASTFLOAT-8380999
- published 14 Nov 2024
- disclosed 12 Nov 2024
- credit Alexander Huszagh
How to fix?
There is no fixed version for fast-float.
Overview
fast-float is a crate that provides a super-fast decimal number parser from strings into floats.
Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified, or Implementation-Defined Behavior when checking input length and due to functions marked as safe with non-local safety guarantees.
Note:
There is a maintained fork of this package, containing a fix for this vulnerability: fast-float2