CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service
Attackers can cause memory exhaustion and application crashes by providing specific untrusted inputs to the Solana JavaScript SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-30253?
CVE-2024-30253 is a high-severity denial of service vulnerability in solana-labs solana-web3.js, published on 17 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.
Weakness: CWE-119
Which versions are affected by CVE-2024-30253?
40 open source packages ship an affected version, including @solana/web3.js.
| Package | Affected | Fixed in |
|---|---|---|
@solana/web3.js npm | All versions | 1.0.1 |
@solana/web3.js npm | All versions | 1.0.1 |
@solana/web3.js npm | From 1.1.0 | 1.1.2 |
@solana/web3.js npm | From 1.1.0 | 1.1.2 |
@solana/web3.js npm | From 1.10.0 | 1.10.2 |
@solana/web3.js npm | From 1.10.0 | 1.10.2 |
34 more packages
@solana/web3.js npm | From 1.11.0 | 1.11.1 |
@solana/web3.js npm | From 1.11.0 | 1.11.1 |
@solana/web3.js npm | From 1.12.0 | 1.12.1 |
@solana/web3.js npm | From 1.12.0 | 1.12.1 |
@solana/web3.js npm | From 1.13.0 | 1.13.1 |
@solana/web3.js npm | From 1.13.0 | 1.13.1 |
@solana/web3.js npm | From 1.14.0 | 1.14.1 |
@solana/web3.js npm | From 1.14.0 | 1.14.1 |
@solana/web3.js npm | From 1.15.0 | 1.15.1 |
@solana/web3.js npm | From 1.15.0 | 1.15.1 |
@solana/web3.js npm | From 1.16.0 | 1.16.2 |
@solana/web3.js npm | From 1.16.0 | 1.16.2 |
@solana/web3.js npm | From 1.17.0 | 1.17.1 |
@solana/web3.js npm | From 1.17.0 | 1.17.1 |
@solana/web3.js npm | From 1.18.0 | 1.18.1 |
@solana/web3.js npm | From 1.18.0 | 1.18.1 |
@solana/web3.js npm | From 1.19.0 | 1.19.1 |
@solana/web3.js npm | From 1.19.0 | 1.19.1 |
@solana/web3.js npm | From 1.2.0 | 1.2.8 |
@solana/web3.js npm | From 1.2.0 | 1.2.8 |
@solana/web3.js npm | From 1.20.0 | 1.20.3 |
@solana/web3.js npm | From 1.20.0 | 1.20.3 |
@solana/web3.js npm | From 1.21.0 | 1.21.1 |
@solana/web3.js npm | From 1.21.0 | 1.21.1 |
@solana/web3.js npm | From 1.22.0 | 1.22.1 |
@solana/web3.js npm | From 1.22.0 | 1.22.1 |
@solana/web3.js npm | From 1.23.0 | 1.23.1 |
@solana/web3.js npm | From 1.23.0 | 1.23.1 |
@solana/web3.js npm | From 1.24.0 | 1.24.3 |
@solana/web3.js npm | From 1.24.0 | 1.24.3 |
@solana/web3.js npm | From 1.25.0 | 1.25.1 |
@solana/web3.js npm | From 1.25.0 | 1.25.1 |
@solana/web3.js npm | From 1.26.0 | 1.26.1 |
@solana/web3.js npm | From 1.26.0 | 1.26.1 |
How do I fix CVE-2024-30253?
Upgrade @solana/web3.js to a fixed version for your release line: 1.0.1, 1.1.2, 1.10.2 or 1.11.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-30253 being exploited?
There is no known exploitation of CVE-2024-30253 in the wild and no public exploit code.
Sources
Also known as GHSA-8m45-2rjm-j347.