Description
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | parse_duration | <= 2.1.1 | — | GHSA-qpgv-g792-wh6x |
| crates.io | parse_duration | >= 0.0.0-0 | — | RUSTSEC-2021-0041 |