high7.5
CVE-2024-58264
serde-json-wasm stack overflow during recursive JSON parsing
Impact
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | serde-json-wasm | = 1.0.0 | 1.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cosmwasm | Serde-Json-Wasm | before 1.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://crates.io/crates/serde-json-wasm
- https://github.com/advisories/GHSA-rr69-rxr6-8qwf
- https://rustsec.org/advisories/RUSTSEC-2024-0012.html
- https://github.com/CosmWasm/serde-json-wasm/commit/a9a9b9bf243862bd2afbf6853fca97f30dc4f620
- https://github.com/CosmWasm/serde-json-wasm/commit/e78f9e28b3a2151d3175ee88ab2a001bf9515429
- https://nvd.nist.gov/vuln/detail/CVE-2024-58264