Denial of Service in smol-toml via Malformed TOML

The smol-toml library is susceptible to a denial-of-service (DoS) vulnerability, tracked as CVE-2026-85730. The vulnerability resides in the parse() function, which fails to correctly handle specific malformed TOML documents. When an array or inline table within a TOML document is followed by a comment that lacks a trailing newline at the end of the file, the parser's internal logic enters an infinite loop. During this loop, the parser incorrectly resets its cursor to the beginning of the input string, resulting in the thread pinning CPU usage at 100%. This vulnerability poses a significant risk to applications that parse arbitrary or untrusted TOML input, as a single malicious payload can effectively hang the application process. Defenders should prioritize updating the library to version 1.7.1 or later, where the parser logic has been corrected to exit the loop and return a proper TomlError.

Impact

Applications that ingest and parse untrusted TOML input are highly vulnerable to service disruption. Successfully triggering this flaw causes immediate and persistent 100% CPU utilization, rendering the service unresponsive. This is particularly critical for web services or APIs that utilize smol-toml to process configuration files or user-provided data, potentially leading to widespread outages for dependent systems.

Recommendation

• Upgrade smol-toml to version 1.7.1 or later immediately to address CVE-2026-85730.
• Audit application codebases to identify services that utilize smol-toml for parsing external, unvalidated TOML data.
• Implement request timeout mechanisms and resource limits (CPU/memory) on processes responsible for parsing untrusted data to mitigate the impact of potential hanging conditions.