smol-toml is a lightweight TOML parser. A logic flaw in its parse() function causes an infinite loop when a comment follows a value in an array or inline table without a trailing newline. The loop never exits, causing the parsing process to consume processing capacity indefinitely and leading to a denial of service. The vulnerability directly compromises the integrity of the service’s availability, as an attacker can repeatedly submit malicious TOML documents to exhaust system resources. The flaw is a classic example of unchecked input handling and resource exhaustion.

The affected product is smol-toml, distributed by squirrelchat. All releases prior to v1.7.1 contain the vulnerability; the bug was fixed in commit 30f5c367d946b695f379b5d4f0946b2f0a0a8c2f and released in v1.7.1. Applications that parse TOML input using any version older than 1.7.1 are potentially vulnerable.

The CVSS score of 8.2 indicates high severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. The vulnerability requires an attacker to supply malformed TOML input; if an application accepts such input from a remote source, the attacker can trigger the infinite loop and cause a denial of service. The likely attack vector is remote, through any interface that accepts TOML data.