RUSTSEC-2025-0002: Segmentation fault due to lack of bound check

What to do

1. See which version you have: cargo tree -i fast-float2 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p fast-float2. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example fast-float2 = "0.2.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

In this case, the "fast_float2::common::AsciiStr::first" method within the "AsciiStr" struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by "self.ptr". Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input. This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided.

References

• Package: crates.io/crates/fast-float2
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0002.html
• Report: github.com/aldanor/fast-float-rust/issues/38

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.