Approved changes feed: RSS · Atom
cpe:2.3:a:alloy-rs:core:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Alloy Rs (f85a6368-fce6-51a9-b177-517eb0ef7cd5) |
|---|---|
| Product | Core (9a144cce-45d2-5013-92dc-84fb6b2d5f42) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-62370 |
vulnerable | 2026-06-08 07:37:29.585855 |
Alloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
HIGH (7.5)
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
Published: 2025-10-15T15:32:17.686Z
Updated: 2025-10-15T17:23:13.068Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.