Priority LOW 28
Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations.
Vulnerabilities
5 records
TI-2024-07307 CVE-2024-7884 · GHSA-rwq6-crjg-9cpw
Memory leak when calling a canister method via `ic_cdk::call`
Priority MEDIUM 40
When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result.
TI-2024-04125 CVE-2024-4435 · GHSA-3rcq-39xp-7xjp
BTreeMap memory leak when deallocating nodes with overflows
Priority LOW 33
When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks".
TI-2024-01514 CVE-2024-1631 · GHSA-c9vv-fhgv-cjc3
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
Priority MEDIUM 49
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key.
TI-2023-05736 CVE-2023-6245 · GHSA-7787-p7x6-fq3j
Infinite decoding loop through specially crafted payload
Priority MEDIUM 41
The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type.