PT-2025-11265 · Azle · Azle

Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-29776

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Azle versions 0.27.0 through 0.29.0

Description: The issue arises when calling setTimer in the affected Azle versions, resulting in an immediate infinite loop of timers. Each timer attempts to clean up the global state of the previous timer. This loop occurs with any valid invocation of setTimer.

Recommendations: For versions 0.27.0 through 0.29.0, upgrade to version 0.30.0 to fix the issue. As a temporary workaround for canisters caught in the infinite loop after calling setTimer, consider upgrading the canister to clear timers and end the loop.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2025-29776

GHSA-XC76-5PF9-MX8M

Affected Products

Azle

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29776.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29776 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29776 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xc76-5pf9-mx8m · Vendor Advisory
• https://github.com/demergent-labs/azle/security/advisories/GHSA-xc76-5pf9-mx8m · Note
• https://github.com/demergent-labs/azle/releases/tag/0.30.0 · Note
• https://github.com/demergent-labs/azle · Note
• https://t.me/cvedetector/20301 · Telegram Post
• https://t.me/cvetracker/19129 · Telegram Post
• https://twitter.com/CveFindCom/status/1900540311471804872 · Twitter Post
• https://twitter.com/CVEnew/status/1900538660564472290 · Twitter Post