PT-2024-40177 · Unknown · Alloy-Json-Abi

Published 2024-08-15 · Updated 2024-08-15

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: alloy-json-abi (affected versions not specified)

Description: The issue arises from improper handling of malformatted JSON ABI strings by the alloy-json-abi crate. Specifically, the JsonAbi::parse method can be exploited to cause a stack overflow when processing specially crafted input, potentially leading to a denial of service due to application crashes.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-8327-84CJ-8XJM

Affected Products

Alloy-Json-Abi

References · 5

• https://osv.dev/vulnerability/GHSA-8327-84cj-8xjm · Vendor Advisory
• https://github.com/alloy-rs/core · Note
• https://github.com/alloy-rs/core/commit/4790c47518024bd391bbd6815b00f501bad76a15 · Note
• https://github.com/alloy-rs/core/issues/702 · Note
• https://rustsec.org/advisories/RUSTSEC-2024-0362.html · Note