CVE-2025-62370High· 7.5▾ TwilightAlloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Sof…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
alloy-dyn-abi >= 1.0.0, < 1.4.1Patched in:
alloy-dyn-abi 1.4.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-61544High· 8.2libp2p-rust is the official Rust language implementation of the libp2p networking stack
CVE-2026-72813High· 7.5actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files
CVE-2026-44001High· 8.6vm2 is an open source vm/sandbox for Node.js
CVE-2026-116589High· 8.2Datadog dd-trace-py: IAST instrumentation can lead to application DOS
CVE-2026-116173High· 7.5vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassi…