PT-2025-11265 · Azle · Azle

Publicado 2025-03-14 · Atualizado 2025-03-14 · CVE-2025-29776

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Azle versions 0.27.0 through 0.29.0

Description: The issue arises when calling setTimer in the affected Azle versions, resulting in an immediate infinite loop of timers. Each timer attempts to clean up the global state of the previous timer. This loop occurs with any valid invocation of setTimer.

Recommendations: For versions 0.27.0 through 0.29.0, upgrade to version 0.30.0 to fix the issue. As a temporary workaround for canisters caught in the infinite loop after calling setTimer, consider upgrading the canister to clear timers and end the loop.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2025-29776

GHSA-XC76-5PF9-MX8M

Produtos afetados

Azle

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29776.json · Exploit
• https://github.com/demergent-labs/azle/security/advisories/GHSA-xc76-5pf9-mx8m · Nota
• https://github.com/demergent-labs/azle/releases/tag/0.30.0 · Nota
• https://github.com/demergent-labs/azle · Nota
• https://t.me/cvedetector/20301 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-29776 · Nota de Segurança
• https://t.me/cvetracker/19129 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-29776 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/1900540311471804872 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1900538660564472290 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-xc76-5pf9-mx8m · Aviso do Fabricante