RUSTSEC-2021-0109: Process crashes when the cell used as DepGroup is not alive

What to do

1. See which version you have: cargo tree -i ckb (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p ckb. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example ckb = "0.40.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

It's easy to create a malign transaction which uses the dead cell as the DepGroup in the DepCells. The transaction can crash all the receiving nodes.

References

• Package: crates.io/crates/ckb
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0109.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for ckb

• VulnerabilityRUSTSEC-2021-0107 · 2021-07-25Miner fails to get block template when a cell used as a cell dep has been destroyed.
• VulnerabilityRUSTSEC-2021-0108 · 2021-07-25Remote memory exhaustion in ckb
• VulnerabilityGHSA-29c2-65rj-h343 · 2024-02-03Nervos CKB Permit load cell data from memory
• VulnerabilityGHSA-29c2-65rj-h343 · 2024-02-03Nervos CKB Permit load cell data from memory
• VulnerabilityGHSA-29c2-65rj-h343 · 2024-02-03Nervos CKB Permit load cell data from memory
• VulnerabilityGHSA-29c2-65rj-h343 · 2024-02-03Nervos CKB Permit load cell data from memory
• VulnerabilityGHSA-29c2-65rj-h343 · 2024-02-03Nervos CKB Permit load cell data from memory
• VulnerabilityGHSA-3gjh-29fv-8hr6 · 2024-02-03Nervos CKB Snappy decompress length can be very large and causes out of memory error

Full security history of ckb