CVE-2025-62370Alloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
Updated under an hour ago ()
Does this affect you?
It affects alloy-rs core. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-248
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
alloy-rs core alloy_rs:core (from the name) | before 0.8.26; from 1.0.0, < 1.4.1 | CNA record |
References
- https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2x-refsource-confirm
- https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccfx-refsource-misc
- https://crates.io/crates/alloy-dyn-abi/0.8.26x-refsource-misc
- https://crates.io/crates/alloy-dyn-abi/1.4.1x-refsource-misc
- https://rustsec.org/advisories/RUSTSEC-2025-0073.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.