PT-2025-42374 · Unknown · Alloy Core

Published 2025-10-15 · Updated 2025-10-21 · CVE-2025-62370

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Alloy Core libraries versions prior to 0.8.26 Alloy Core libraries versions prior to 1.4.1

Description A flaw exists in Alloy Core libraries that could lead to a denial-of-service (DoS) condition. This issue is triggered by malformed input to the alloy dyn abi::TypedData function, specifically within the eip712 signing hash() function. Systems requiring high availability, such as network services, may be especially vulnerable. External auto-restarting mechanisms can offer partial mitigation, but repeated attacks could still cause availability issues. The root cause is a lack of a check for empty elements before accessing them, leading to an uncaught panic.

Recommendations Update Alloy Core libraries to version 0.8.26 or later. Update Alloy Core libraries to version 1.4.1 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-248

CWE-20

Related Identifiers

CVE-2025-62370

GHSA-PGP9-98JM-WWQ2

OPENSUSE-SU-2025:15652-1

RUSTSEC-2025-0073

Affected Products

Alloy Core

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62370.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15652-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62370 · Security Note
• https://osv.dev/vulnerability/GHSA-pgp9-98jm-wwq2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62370 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0073 · Vendor Advisory
• https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf · Note
• https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2 · Note
• https://github.com/alloy-rs/core · Note
• https://crates.io/crates/alloy-dyn-abi/0.8.26 · Note
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post
• https://suse.com/security/cve/CVE-2025-62370 · Note
• https://crates.io/crates/alloy-dyn-abi · Note
• https://twitter.com/CVEnew/status/1978545044358644032 · Twitter Post
• https://crates.io/crates/alloy-dyn-abi/1.4.1 · Note