AIKIDO-2025-10065
fast-float is vulnerable to Out-of-bounds Read
26
Low Risk
This Affects:
fast-floatTL;DR
In this case, the fast_float::common::AsciiStr::first method within the AsciiStr struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by self.ptr. Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input. This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided. No patched version for fast-float crate has been released, but a patch is available in the fast-float2 fork.
Who does this affect?
You are affected if you use the fast-float package.
Background info
fast-float is vulnerable to Out-of-bounds Read in versions 0.1.0 - 0.2.0.
How to fix this
Remove fast-float from your application and replace with the fast-float2 package version >=0.2.2.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant