Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

evm-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5crates.ioPublished

    Memory over-allocation in evm crate

    CVE-2021-29511 · GHSA-4jwq-572w-4388

    Affected
    • crates.io evm-core <= 0.21.0; >= 0.22.0, <= 0.22.0; >= 0.23.0, <= 0.23.0; >= 0.24.0, <= 0.24.0; >= 0.25.0, <= 0.25.0; >= 0.26.0, <= 0.26.0
    Fixed in
    0.25.10.22.10.24.10.23.10.26.10.21.1· Vendor fix available
    Issue
    Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, =0.26.1. Workarounds None. Please upgrade your evm crate version References Fix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd For more information If you have any questions or comments about this advisory: Open an issue in evm repo Email Wei

    Recommended action: Upgrade to 0.26.1, 0.25.1, 0.24.1 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Unratedcrates.ioPublished

    Memory over-allocation in evm-core

    GHSA-773q-5334-5gf9

    Affected
    • crates.io evm-core >= 0.26.0, < 0.26.1; >= 0.25.0, < 0.25.1; >= 0.24.0, < 0.24.1; >= 0.23.0, < 0.23.1; < 0.21.1
    Fixed in
    0.25.10.24.10.23.10.26.10.21.1· Vendor fix available
    Issue
    Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85.

    Recommended action: Upgrade to 0.26.1, 0.25.1, 0.24.1 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →