Unsound LowRUSTSEC-2024-0379 · fast-float
RUSTSEC-2024-0379: Multiple soundness issues
Short answerfast-float has an API that can cause undefined behaviour from safe code: Multiple soundness issues. No fixed version yet.
| Crate | fast-float |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Low (GitHub rating) |
| Published | 2024-10-31 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-x8jh-xj3x-gx3c |
What to do
- Find who pulls it in:
cargo tree -i fast-float. - Avoid the affected API, or replace the crate.
Details from the advisory
fast-float contains multiple soundness issues:
1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees
The library is also unmaintained.
Alternatives
For quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of lexical has been merged into libcore. When requiring direct parsing from bytes and/or partial parsers, the fast-float2 fork of fast-float containing these security patches and reduces overall usage of unsafe.
References
- Package: crates.io/crates/fast-float
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0379.html
- Report: github.com/aldanor/fast-float-rust/issues/35
- Report: github.com/aldanor/fast-float-rust/issues/28
- Report: github.com/aldanor/fast-float-rust/issues/37
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for fast-float
Up next
Same cratefast-float: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?