GHSA-8327-84cj-8xjm Stack overflow when parsing specially crafted JSON ABI strings
Attackers can cause a denial of service by sending specially crafted JSON ABI strings that trigger a stack overflow in the alloy-json-abi crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8327-84cj-8xjm?
GHSA-8327-84cj-8xjm is a denial of service vulnerability in alloy-json-abi, published on 30 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of the alloy-json-abi crate did not properly handle parsing of malformatted JSON ABI strings. The JsonAbi::parse method can be tricked into a stack overflow when processing specially crafted input.
This stack overflow can lead to a crash of the application using this crate, potentially causing a denial of service.
The flaw was corrected in commit 4790c47.
Which versions are affected by GHSA-8327-84cj-8xjm?
3 open source packages ship an affected version, including alloy-json-abi.
| Package | Affected | Fixed in |
|---|---|---|
alloy-json-abi crates.io | All versions to 0.7.7 | None |
alloy-json-abi crates.io | All versions to 0.7.7 | None |
alloy-json-abi crates.io | From 0.0.0-0 | 0.7.7 |
How do I fix GHSA-8327-84cj-8xjm?
Upgrade alloy-json-abi to 0.7.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-8327-84cj-8xjm being exploited?
There is no known exploitation of GHSA-8327-84cj-8xjm in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0362.