Skip to content
Fencer Vulns
high 7.5

HSEC-2023-0007 json

readFloat: memory exhaustion with large exponent

published 2025-11-14 11 mo ago modified 2026-05-29 5 mo ago

cvss
7.5
version 3.1, OSV
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

# `readFloat`: memory exhaustion with large exponent

`Numeric.readFloat` takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4:

``` ghci> import qualified Numeric ghci> Numeric.readFloat "1e1000000" -- near instantaneous [(Infinity,"")] ghci> Numeric.readFloat "1e10000000" -- perceptible pause [(Infinity,"")] ghci> Numeric.readFloat "1e100000000" -- ~ 3 seconds [(Infinity,"")] ghci> Numeric.readFloat "1e1000000000" -- ~ 35 seconds [(Infinity,"")] ```

## In *base*

`Numeric.readFloat` is defined for all `RealFrac a => a`:

```haskell readFloat :: RealFrac a => ReadS a ```

The `RealFrac` type class does not express any bounds on the size of values representable in the types for which instances exist, so bounds checking is not possible (in this *generic* function). `readFloat` uses to `Text.Read.Lex.numberToRational` which, among other things, calculates `10 ^ exponent`, which seems to take linear time and memory.

**Mitigation:** use `read`. The `Read` instances for `Float` and `Double` perform bounds checks on the exponent, via `Text.Read.Lex.numberToRangedRational`.

## In *toml-reader*

The issue was detected in *toml-reader* version 0.1.0.0, and mitigated in version 0.2.0.0 by immediately returning `Infinity` when the exponent is large enough that there's no reason to process it.

Patch / fix

  • hackage toml-reader 0.2.0.0

CVSS scores

assigned by version score vector
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
hackage base
>=3.0.3.1
no fix listed
hackage toml-reader
>=0.1.0.0, <0.2.0.0
0.2.0.0

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.