What is CVE-2020-35923?

CVE-2020-35923 is a medium-severity security vulnerability in ordered-float (rust), affecting versions = 2.0.0. It is fixed in 2.0.1, 1.1.1.

How severe is CVE-2020-35923?

CVE-2020-35923 has a CVSS score of 5.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of ordered-float are affected by CVE-2020-35923?

ordered-float (rust) versions = 2.0.0 is affected.

Is there a fix for CVE-2020-35923?

Yes. CVE-2020-35923 is fixed in 2.0.1, 1.1.1. Upgrade to this version or later.

Is CVE-2020-35923 exploitable, and should I be worried?

Whether CVE-2020-35923 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2020-35923 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2020-35923 in ordered-float

Q: How do I fix CVE-2020-35923?

Upgrade: ordered-float to 2.0.1 or later, ordered-float to 1.1.1 or later.

Summary

ordered_float:NotNan may contain NaN after panic in assignment operators

After using an assignment operators such as NotNan::add_assign, NotNan::mul_assign, etc., it was possible for the resulting NotNan value to contain a NaN. This could cause undefined behavior in safe code, because the safe NotNan::cmp method contains internal unsafe code that assumes the value is never NaN. (It could also cause undefined behavior in third-party unsafe code that makes the same assumption, as well as logic errors in safe code.)

This was mitigated starting in version 0.4.0, by panicking if the assigned value is NaN. However, in affected versions from 0.4.0 onward, code that uses the NotNan value during unwinding, or that continues after catching the panic, could still observe the invalid value and trigger undefined behavior.

The flaw is fully corrected in versions 1.1.1 and 2.0.1, by ensuring that the assignment operators panic without modifying the operand, if the result would be NaN.

Impact

CVE-2020-35923 has a CVSS score of 5.5 (Medium). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.1, 1.1.1); upgrading removes the vulnerable code path.

Affected versions

ordered-float (= 2.0.0) ordered-float (>= 0.2.2, < 1.1.1)

Security releases

ordered-float → 2.0.1 (rust) ordered-float → 1.1.1 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

ordered-float to 2.0.1 or later; ordered-float to 1.1.1 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2020-35923? CVE-2020-35923 is a medium-severity security vulnerability in ordered-float (rust), affecting versions = 2.0.0. It is fixed in 2.0.1, 1.1.1.
How severe is CVE-2020-35923? CVE-2020-35923 has a CVSS score of 5.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of ordered-float are affected by CVE-2020-35923? ordered-float (rust) versions = 2.0.0 is affected.
Is there a fix for CVE-2020-35923? Yes. CVE-2020-35923 is fixed in 2.0.1, 1.1.1. Upgrade to this version or later.
Is CVE-2020-35923 exploitable, and should I be worried? Whether CVE-2020-35923 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2020-35923 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2020-35923?
- Upgrade ordered-float to 2.0.1 or later
- Upgrade ordered-float to 1.1.1 or later