GHSA-8m45-2rjm-j347HighCVSS 7.5

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Published
April 17, 2024
Last Modified
April 17, 2024

🔗 CVE IDs covered (1)

CVE-2024-30253 →

📋 Description

Using particular inputs with @solana/web3.js will result in memory exhaustion (OOM).

If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability.

🎯 Affected products92

  • npm/@solana/web3.js:>= 1.91.0, < 1.91.3
  • npm/@solana/web3.js:>= 1.90, < 1.90.2
  • npm/@solana/web3.js:>= 1.89, < 1.89.2
  • npm/@solana/web3.js:= 1.88.0
  • npm/@solana/web3.js:>= 1.87.0, < 1.87.7
  • npm/@solana/web3.js:= 1.86.0
  • npm/@solana/web3.js:= 1.85.0
  • npm/@solana/web3.js:= 1.84.0
  • npm/@solana/web3.js:= 1.83.0
  • npm/@solana/web3.js:= 1.82.0
  • npm/@solana/web3.js:= 1.81.0
  • npm/@solana/web3.js:= 1.80.0
  • npm/@solana/web3.js:= 1.79.0
  • npm/@solana/web3.js:>= 1.78, < 1.78.8
  • npm/@solana/web3.js:>= 1.77, < 1.77.4
  • npm/@solana/web3.js:= 1.76.0
  • npm/@solana/web3.js:= 1.75.0
  • npm/@solana/web3.js:= 1.74.0
  • npm/@solana/web3.js:>= 1.73.0, < 1.73.5
  • npm/@solana/web3.js:= 1.72.0
  • npm/@solana/web3.js:= 1.71.0
  • npm/@solana/web3.js:>= 1.70.0, < 1.70.4
  • npm/@solana/web3.js:= 1.69.0
  • npm/@solana/web3.js:>= 1.68.0, < 1.68.2
  • npm/@solana/web3.js:>= 1.67.0, < 1.67.3
  • npm/@solana/web3.js:>= 1.66.0, < 1.66.6
  • npm/@solana/web3.js:= 1.65.0
  • npm/@solana/web3.js:= 1.64.0
  • npm/@solana/web3.js:>= 1.63.0, < 1.63.2
  • npm/@solana/web3.js:>= 1.62.0, < 1.62.2
  • +62 more not shown

🔗 References (4)