CVE-2025-62370
alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
Impact
### Impact An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`. Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. ### Patches The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version [`v1.4.1`](https://crates.io/crates/alloy-dyn-abi/1.4.1) and backported to [`v0.8.26`](https://crates.io/crates/alloy-dyn-abi/0.8.26). ### Workarounds There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action. ### Reported by Christian Reitter & Zeke Mostov from [Turnkey](https://www.turnkey.com/)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | alloy-dyn-abi | < 0.8.26 | 0.8.26 |
Affected products
| Product | Affected versions |
|---|---|
| Rust Ethereum Ecosystem. | before 0.8.26 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://crates.io/crates/alloy-dyn-abi/0.8.26
- https://crates.io/crates/alloy-dyn-abi/1.4.1
- https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf
- https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2
- https://rustsec.org/advisories/RUSTSEC-2025-0073.html
- https://github.com/advisories/GHSA-pgp9-98jm-wwq2
- https://nvd.nist.gov/vuln/detail/CVE-2025-62370