Scientific: Superlinear encoding of numbers with large coefficients
Affects scientificSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.3.9.0
Data as of 3 Nov 2026, 23:43 UTC
What to do
Upgrade scientific to 0.3.9.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagescientific | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade the scientific library to version 0.3.10.0 or later, which contains the fix for the performance issue and the regression introduced in 0.3.9.0. No other mitigation is required as the issue is resolved in these versions.
Description
The scientific library versions prior to 0.3.9.0 had a performance issue in encoding numbers with large coefficients, causing encoding time to be quadratic in the number of digits. This could lead to denial-of-service (DoS) risks in applications that re-encode untrusted JSON numbers, such as proxies or API gateways using aeson. The issue was fixed in version 0.3.9.0 by reimplementing digit extraction to be practically linear, with a recommendation to upgrade to 0.3.10.0 or later to avoid a regression introduced in 0.3.9.0.