HSEC-2023-0007
readFloat: memory exhaustion with large exponent
Published Nov 14, 2025 · updated May 29, 2026
# : memory exhaustion with large exponent takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4: ## In *base* is defined for all : The type class does not express any bounds on the size of values representable in the types for which instances exist, so bounds checking is not possible (in this *generic* function). uses to which, among other things, calculates , which seems to take linear time and memory. **Mitigation:** use . The instances for and perform bounds checks on the exponent, via . ## In *toml-reader* The issue was detected in *toml-reader* version 0.1.0.0, and mitigated in version 0.2.0.0 by immediately returning when the exponent is large enough that there's no reason to process it.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Nov 14, 2025 · OSV.dev
Detected
# : memory exhaustion with large exponent takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4: ## In *base* is defined for all : The type class does not express any bounds o
May 29, 2026 · OSV.dev
Fix available
toml-reader fixed in 0.2.0.0
May 29, 2026 · OSV.dev
Fix available
toml-reader fixed in 0.2.0.0
May 29, 2026 · OSV.dev
Updated
# : memory exhaustion with large exponent takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4: ## In *base* is defined for all : The type class does not express any bounds o
Affected
- Hackage base3.0.3.1, 3.0.3.2, 4.0.0.0
- Hackage toml-reader0.1.0.0 → 0.2.0.0