RUSTSEC-2021-0041

Dashboard / Vulnerabilities / RUSTSEC-2021-0041

RUSTSEC-2021-0041

Summary: Denial of service through parsing payloads with too big exponent

Details: The `parse_duration::parse` function allows for parsing duration strings with exponents like `5e5s` where under the hood, the [`BigInt` type along with the `pow` function are used for such payloads](https://github.com/zeta12ti/parse_duration/blob/26940ab5cd4e3a9d6bd97aa101f8d4bbfd18ee8c/src/parse.rs#L335). Passing an arbitrarily big exponent makes the `parse_duration::parse` function to process the payload for a very long time taking up CPU and memory. This allows an attacker to cause a DoS if the `parse_duration::parse` function is used to process untrusted input.

References: https://crates.io/crates/parse_duration, https://rustsec.org/advisories/RUSTSEC-2021-0041.html, https://github.com/zeta12ti/parse_duration/issues/21