Alloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alloy-rs | core | before 0.8.26; 1.0.0 to before 1.4.1 | 0.8.26, 1.4.1 | Patch available | CNA |
| — | alloy-dyn-abi (crates.io) | before 0.8.26 | 0.8.26 | Patch available | GHSA-pgp9-98jm-wwq2 |
| — | alloy-dyn-abi (crates.io) | 1.0.0 to before 1.4.1 | 1.4.1 | Patch available | GHSA-pgp9-98jm-wwq2 |
- core Vendoralloy-rs Affected before 0.8.26; 1.0.0 to before 1.4.1 Fixed in 0.8.26, 1.4.1 Patch available CNA
- alloy-dyn-abi (crates.io) Vendor— Affected before 0.8.26 Fixed in 0.8.26 Patch available GHSA-pgp9-98jm-wwq2
- alloy-dyn-abi (crates.io) Vendor— Affected 1.0.0 to before 1.4.1 Fixed in 1.4.1 Patch available GHSA-pgp9-98jm-wwq2
Remediation
- Fix · CNA core (alloy-rs) Fixed in 0.8.26, 1.4.1
- Fix · GHSA-pgp9-98jm-wwq2 alloy-dyn-abi (crates.io) Fixed in 0.8.26 Advisory →
- Fix · GHSA-pgp9-98jm-wwq2 alloy-dyn-abi (crates.io) Fixed in 1.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62370
- 2026-10-03 Alias added: GHSA-pgp9-98jm-wwq2
References
Other 6
- https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2
- https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf
- https://crates.io/crates/alloy-dyn-abi/0.8.26
- https://crates.io/crates/alloy-dyn-abi/1.4.1
- https://rustsec.org/advisories/RUSTSEC-2025-0073.html
- https://github.com/alloy-rs/core
Sources
- CVE-2025-62370 · CVE Program
- CVE-2025-62370 · NVD
- FIRST EPSS
- GHSA-pgp9-98jm-wwq2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences