Vulnerability MediumRUSTSEC-2025-0003 · fast-float
RUSTSEC-2025-0003: Segmentation fault due to lack of bound check
Short answerA security vulnerability in the fast-float crate: Segmentation fault due to lack of bound check. GitHub rates it Medium. No fixed version: replace the crate or remove the affected code path.
| Crate | fast-float |
|---|---|
| Type | Vulnerability (memory-exposure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2025-01-13 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-8655-xgh5-5vvq |
| Affected functions | fast_float::common::AsciiStr::first |
What to do
- Find who pulls it in:
cargo tree -i fast-float. - Avoid the affected API (
fast_float::common::AsciiStr::first), or replace the crate.
Details from the advisory
In this case, the "fast_float::common::AsciiStr::first" method within the "AsciiStr" struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by "self.ptr". Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input. This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided.
No patched version for fast-float crate has been released, but a patch is available in the fast-float2 fork.
References
- Package: crates.io/crates/fast-float
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0003.html
- Report: github.com/aldanor/fast-float-rust/issues/38
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for fast-float
Up next
Same cratefast-float: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?