{"answers":{"affected":"2 open source packages ship an affected version, including eth-abi.","exploited":"There is no known exploitation of GHSA-rqr8-pxh7-cq3g in the wild and no public exploit code.","fix":"Upgrade eth-abi to 4.2.0 or later.","what":"GHSA-rqr8-pxh7-cq3g is a denial of service vulnerability in eth-abi, published on 24 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-rqr8-pxh7-cq3g and fix it if it is affected.\n\nWhat it is: GHSA-rqr8-pxh7-cq3g is a denial of service vulnerability in eth-abi, published on 24 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-rqr8-pxh7-cq3g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- eth-abi (PyPI): affected all versions; fixed in 4.2.0\n- eth-abi (PyPI): affected all versions; fixed in 4.2.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-rqr8-pxh7-cq3g/ (Markdown: https://insights.sbomify.com/GHSA-rqr8-pxh7-cq3g/index.md)","id":"GHSA-rqr8-pxh7-cq3g","markdown":"https://insights.sbomify.com/GHSA-rqr8-pxh7-cq3g/index.md","name":"GHSA-rqr8-pxh7-cq3g","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"no_fix_stated","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Ethereum ABI decoder","requires_auth":"none","summary":"A denial-of-service vulnerability in the Ethereum ABI decoder allows attackers to cause excessive resource consumption by parsing malicious payloads containing zero-sized types.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"With this notification I would like to inform about a DoS vector in the Ethereum ABI decoder. \nWe have not yet found a way to exploit this with high impact, still the bug could potentially lead to a DoS in server systems.\n\nFeel free to ask about an extension of the embargo period.\n\nTrail of Bits is informing you and other vendors as a community service, and so we do not seek a bug bounty on these issues.\n\n## BUG DESCRIPTION\n\nParsers must be written in a robust way, which avoids for example unrecoverable crashes, misinterpretation, hangs, or excessive resource consumption. The recent news about the aCropalypse bug also highlights that more subtle bugs like blind spots in file formats can lead to serious implications. Sometimes the specifications are at fault and sometimes the implementations.\n\nIn the case of the Ethereum ABI, I have to blame the specification more than the vulnerable implementations. The specification allows zero-sized-types (ZST), which can cause denial-of-service upon parsing a malicious payload and schema. If a ZST takes zero bytes when stored on disk, but after parsing occupies memory, then there is the possibility for a denial of service.\n\nFor instance, what will happen if a parser expects an array of ZST? It will try to parse as many ZST as the byte array claims to contain. The following figure first shows a payload of 20 bytes which will deserialize to an array of the numbers 2, 1, 3. The second payload will deserialize to 232 elements of a ZST like an empty tuple or empty array. \n\n20 bytes of data:\n```\nlength=0x3u64 2u32 1u32 3u32\n```\n8 bytes of data\n```\nlength=0xFFFFFFFu64\n```\n\nNow, this is not a problem if the individual elements take zero memory after parsing. Though, a common flaw is at least during serialization a large amount of memory will be required. If this case is not handled explicitly in the implementation then we are facing a DoS vector. For example, an implementation could decide to represent an array of ZST differently than a normal array and parse it in constant time, instead of looping and naively adding elements to an in-memory array.\n\nI mentioned that I believe this is a flaw in the specification. The reason for this is that the Ethereum ABI could have decided to disallow ZST completely. Actually, it turned out that in the latest versions of Solidity and Vyper it is not possible to define ZST like empty tuples or empty arrays. Even though the languages do not allow it, it is still allowed in the ABI specification.\n\n## POC\n\nWe define the data payload as `0x0000000000000000000000000000000000000000000000000000000000000020 00000000000000000000000000000000000000000000000000000000FFFFFFFF`. It consists of two 32-byte blocks, which describe a serialized array of ZST. The first block defines an offset to the array’s elements. The second block defines the length of the array. Independent of the programming language we will reference it always as payload.\n\nWe will try to decode this payload using the ABI schemata ()[] and uint32[0][]. The former represents a dynamic array of empty tuples and the latter a dynamic array of empty static arrays. The distinction between dynamic and static is important here, because an empty static array takes zero bytes, whereas a dynamic one takes a few bytes because it serializes the length of the array.\n\nThe following Python program uses the official eth_abi library and will hang and eventually cause an out-of-memory error.\n\n    from eth_abi import decode\n    data = bytearray.fromhex(payload)\n    decode(['()[]'], data)\n\n## SUGGESTED REMEDIATION\n\nWe suggest to disallow the parsing of ZST.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Ethereum ABI decoder DoS when parsing ZST","id":"GHSA-rqr8-pxh7-cq3g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["4.2.0"],"introduced":["0"],"last_affected":[],"package":"eth-abi","purl":null,"source":"GHSA-rqr8-pxh7-cq3g"},{"ecosystem":"PyPI","fixed":["4.2.0"],"introduced":["0"],"last_affected":[],"package":"eth-abi","purl":"pkg:pypi/eth-abi","source":"GHSA-rqr8-pxh7-cq3g"}],"products":null,"published":"2023-11-24","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A denial-of-service vulnerability in the Ethereum ABI decoder allows attackers to cause excessive resource consumption by parsing malicious payloads containing zero-sized types.","url":"https://insights.sbomify.com/GHSA-rqr8-pxh7-cq3g/"}