PT-2025-27657 · Unknown · Ethereum Crate

Sorpaas · Published 2025-07-02 · Updated 2025-07-03 · CVE-2025-53359

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: ethereum crate versions prior to 0.18.0

Description: The issue concerns a specification deviation in the ethereum crate for Rust, where signature malleability according to EIP-2 was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559, and EIP-7702 transactions. This is not a high-risk security issue, especially if the crate is used on a single-implementation blockchain.

Recommendations: For versions prior to 0.18.0, upgrade to version 0.18.0 to resolve the issue. As a temporary workaround, consider manually checking transaction malleability outside of the crate.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-53359

GHSA-3W94-VQ2X-V5WR

Affected Products

Ethereum Crate

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53359.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53359 · Security Note
• https://osv.dev/vulnerability/GHSA-3w94-vq2x-v5wr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53359 · Vendor Advisory
• https://github.com/rust-ethereum/ethereum · Note
• https://github.com/rust-ethereum/ethereum/pull/67 · Note
• https://github.com/rust-ethereum/ethereum/commit/2dd9d1d5d0936ec7350093ff3a5a7169a349db77 · Note
• https://github.com/rust-ethereum/ethereum/security/advisories/GHSA-3w94-vq2x-v5wr · Note
• https://twitter.com/attritionorg/status/1940831181978980709 · Twitter Post
• https://twitter.com/CVEnew/status/1940445176108925199 · Twitter Post