alloy-rs core up to 0.8.25/1.4.0 alloy_dyn_abi::TypedData uncaught exception

Summaryinfo

A vulnerability was found in alloy-rs core up to 0.8.25/1.4.0. It has been declared as problematic. Affected is the function alloy_dyn_abi::TypedData. Such manipulation leads to uncaught exception. This vulnerability is uniquely identified as CVE-2025-62370. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in alloy-rs core up to 0.8.25/1.4.0 and classified as problematic. Affected by this issue is the function alloy_dyn_abi::TypedData. The manipulation with an unknown input leads to a uncaught exception vulnerability. Using CWE to declare the problem leads to CWE-248. An exception is thrown from a function, but it is not caught. Impacted is availability. CVE summarizes:

Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-62370 since 10/10/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.8.26 or 1.4.1 eliminates this vulnerability. Applying the patch 7823e9af8c20e9fcfb5360f5eafd891c457ebccf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• alloy-rs

Name

• core

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4
• 0.8.5
• 0.8.6
• 0.8.7
• 0.8.8
• 0.8.9
• 0.8.10
• 0.8.11
• 0.8.12
• 0.8.13
• 0.8.14
• 0.8.15
• 0.8.16
• 0.8.17
• 0.8.18
• 0.8.19
• 0.8.20
• 0.8.21
• 0.8.22
• 0.8.23
• 0.8.24
• 0.8.25
• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

Website

• Product: https://github.com/alloy-rs/core/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion