base · readFloat: memory exhaustion with large exponent
Affects baseSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.2.0.0
Data as of 13 Nov 2026, 18:40 UTC
What to do
Upgrade toml-reader to 0.2.0.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagebase | Affected
| Fixed in– |
| Hackagetoml-reader | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Use the read function instead of Numeric.readFloat for parsing floating-point numbers, as read performs exponent bounds checking and avoids excessive resource consumption. For toml-reader users, upgrade to version 0.2.0.0 or later, where the issue is fixed by returning Infinity for large exponents.
Description
The Numeric.readFloat function in the base library and toml-reader package can cause memory exhaustion and denial of service when processing numbers with very large exponents in scientific notation. This is due to linear time and memory usage proportional to the size of the exponent. The issue was detected in toml-reader version 0.1.0.0 and fixed in 0.2.0.0 by returning Infinity for large exponents. Mitigation in base is to use read instead of readFloat, as read performs exponent bounds checking.