Read the docs
TI-2023-30798 Aliases GHSA-c2hm-mjxv-89r4

Multiple soundness issues in lexical

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

`lexical` contains multiple soundness issues: 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102) 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101) 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104) 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95) 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126) The crate also has some correctness issues. ## Alternatives For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. For quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`. For formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate. For working with big numbers consider `num-bigint` and `num-traits`.

Why it matters now

Fix Fixed lexical (crates.io): 7.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—lexical (crates.io)before 7.0.07.0.0Patch availableGHSA-c2hm-mjxv-89r4
  • lexical (crates.io) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-c2hm-mjxv-89r4

Remediation

  • Fix · GHSA-c2hm-mjxv-89r4 lexical (crates.io) Fixed in 7.0.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-c2hm-mjxv-89r4

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences