Rust advisories / parse_duration
Vulnerability HighRUSTSEC-2021-0041 · parse_duration
RUSTSEC-2021-0041: Denial of service through parsing payloads with too big exponent
Short answerA security vulnerability in the parse_duration crate: Denial of service through parsing payloads with too big exponent. High severity (CVSS 7.5). No fixed version: replace the crate or remove the affected code path.
| Crate | parse_duration |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2021-03-18 |
| Last changed | 2023-11-08 |
| Also known as | CAN-2021-1000007, CVE-2021-29932, GHSA-qpgv-g792-wh6x |
| Affected functions | parse_duration::parse |
What to do
- Find who pulls it in:
cargo tree -i parse_duration. - Avoid the affected API (
parse_duration::parse), or replace the crate.
Details from the advisory
The parse_duration::parse function allows for parsing duration strings with exponents like 5e5s where under the hood, the BigInt type along with the pow function are used for such payloads. Passing an arbitrarily big exponent makes the parse_duration::parse function to process the payload for a very long time taking up CPU and memory.
This allows an attacker to cause a DoS if the parse_duration::parse function is used to process untrusted input.
References
- Package: crates.io/crates/parse_duration
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0041.html
- Report: github.com/zeta12ti/parse_duration/issues/21
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?