Read the docs
TI-2024-04125 Aliases CVE-2024-4435GHSA-3rcq-39xp-7xjp

BTreeMap memory leak when deallocating nodes with overflows

Priority LOW 33CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain (incorrectly) allocated, causing a memory leak. In the worst case, depending on how a canister uses the BTreeMap, an adversary could interact with the canister through its API and trigger interactions with the map that keep consuming memory due to the memory leak. This could potentially lead to using an excessive amount of memory, or even running out of memory. This issue has been fixed in #212 https://github.com/dfinity/stable-structures/pull/212  by changing the logic for deallocating nodes to ensure that all of a node's memory chunks are deallocated and users are asked to upgrade to version 0.6.4.. Tests have been added to prevent regressions of this nature moving forward. Note: Users of stable-structure < 0.6.0 are not affected. Users who are not storing unbounded types in BTreeMap are not affected and do not need to upgrade. Otherwise, an upgrade to version 0.6.4 is necessary.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00515 44th percentileScored 2026-11-07
Fix Fixed ic-stable-structures (Internet Computer): 0.6.4ic-stable-structures (crates.io): 0.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Internet Computeric-stable-structures0.6.0 to before 0.6.40.6.4Patch availableCNA
—ic-stable-structures (crates.io)0.6.0 to before 0.6.40.6.4Patch availableGHSA-3rcq-39xp-7xjp
  • ic-stable-structures VendorInternet Computer Affected 0.6.0 to before 0.6.4 Fixed in 0.6.4 Patch available CNA
  • ic-stable-structures (crates.io) Vendor— Affected 0.6.0 to before 0.6.4 Fixed in 0.6.4 Patch available GHSA-3rcq-39xp-7xjp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dfinity:stable_structures:*:*:*:*:*:rust:*:*before 0.6.0VulnerableInternet Computer
  • cpe:2.3:a:dfinity:stable_structures:*:*:*:*:*:rust:*:* Versions before 0.6.0 Vulnerable ·Internet Computer

Remediation

  • Fix · CNA ic-stable-structures (Internet Computer) Fixed in 0.6.4
  • Fix · GHSA-3rcq-39xp-7xjp ic-stable-structures (crates.io) Fixed in 0.6.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-4435
  2. 2026-10-03 Alias added: GHSA-3rcq-39xp-7xjp

References

Sources