GHSA-pgp9-98jm-wwq2
alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
Details
### Impact
An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`.
Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.
### Patches
The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version [`v1.4.1`](https://crates.io/crates/alloy-dyn-abi/1.4.1) and backported to [`v0.8.26`](https://crates.io/crates/alloy-dyn-abi/0.8.26).
### Workarounds
There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.
### Reported by
Christian Reitter & Zeke Mostov from [Turnkey](https://www.turnkey.com/)
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 0.8.26Upgrade alloy-dyn-abi to 0.8.26 or newer (ecosystem crates.io).
1.0.0Fixed in: 1.4.1Upgrade alloy-dyn-abi to 1.4.1 or newer (ecosystem crates.io).
References
- https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-62370[ADVISORY]
- https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf[WEB]
- https://crates.io/crates/alloy-dyn-abi/0.8.26[WEB]
- https://crates.io/crates/alloy-dyn-abi/1.4.1[WEB]
- https://github.com/alloy-rs/core[PACKAGE]
- https://rustsec.org/advisories/RUSTSEC-2025-0073.html[WEB]