https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T02:24:47.328782+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-29932 CVE-2021-29932 2026-10-18T02:24:47.330510+00:00

An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.

 https://cve.radiocsirt.org/vuln/rustsec-2021-0041 RUSTSEC-2021-0041 — Denial of service through parsing payloads with too big exponent 2026-10-18T02:24:47.330559+00:00

Affected: crates.io: parse_duration

The `parse_duration::parse` function allows for parsing duration strings with exponents like `5e5s` where under the hood, the [`BigInt` type along with the `pow` function are used for such payloads](https://github.com/zeta12ti/parse_duration/blob/26940ab5cd4e3a9d6bd97aa101f8d4bbfd18ee8c/src/parse.rs#L335). Passing an arbitrarily big exponent makes the `parse_duration::parse` function to process the payload for a very long time taking up CPU and memory.

This allows an attacker to cause a DoS if the `parse_duration::parse` function is used to process untrusted input.