HSEC-2023-0007 readFloat: memory exhaustion with large exponent

Not scored Published 14 Nov 2025

Attackers can cause denial of service by providing input with large exponents to Numeric.readFloat, exhausting memory and CPU resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is HSEC-2023-0007?

HSEC-2023-0007 is a denial of service vulnerability in base, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

`readFloat`: memory exhaustion with large exponent

Numeric.readFloat takes time and memory linear in the size of the number denoted by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4:

ghci&gt; import qualified Numeric
ghci&gt; Numeric.readFloat &#34;1e1000000&#34;    -- near instantaneous
[(Infinity,&#34;&#34;)]
ghci&gt; Numeric.readFloat &#34;1e10000000&#34;   -- perceptible pause
[(Infinity,&#34;&#34;)]
ghci&gt; Numeric.readFloat &#34;1e100000000&#34;  -- ~ 3 seconds
[(Infinity,&#34;&#34;)]
ghci&gt; Numeric.readFloat &#34;1e1000000000&#34; -- ~ 35 seconds
[(Infinity,&#34;&#34;)]

In base

Numeric.readFloat is defined for all RealFrac a => a:

readFloat :: RealFrac a =&gt; ReadS a

The RealFrac type class does not express any bounds on the size of values representable in the types for which instances exist, so bounds checking is not possible (in this generic function). readFloat uses to Text.Read.Lex.numberToRational which, among other things, calculates 10 ^ exponent, which seems to take linear time and memory.

Mitigation: use read. The Read instances for Float and Double perform bounds checks on the exponent, via Text.Read.Lex.numberToRangedRational.

In toml-reader

The issue was detected in toml-reader version 0.1.0.0, and mitigated in version 0.2.0.0 by immediately returning Infinity when the exponent is large enough that there's no reason to process it.

Which versions are affected by HSEC-2023-0007?

2 open source packages ship an affected version, including base and toml-reader.

Package	Affected	Fixed in
`base` Hackage	From `3.0.3.1`	None
`toml-reader` Hackage	From `0.1.0.0`	`0.2.0.0`

How do I fix HSEC-2023-0007?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is HSEC-2023-0007 being exploited?

There is no known exploitation of HSEC-2023-0007 in the wild and no public exploit code.