Rust advisories / alloy-dyn-abi
Vulnerability HighRUSTSEC-2025-0073 · alloy-dyn-abi
RUSTSEC-2025-0073: DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
Short answerA security vulnerability in the alloy-dyn-abi crate: DoS vulnerability on `alloy_dyn_abi::TypedData` hashing. High severity (CVSS 7.5). Fixed in 0.8.26, 1.4.1: update to a fixed version.
| Crate | alloy-dyn-abi |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.8.26; from 1.0.0 before 1.4.1. |
| Fixed in | 0.8.26, 1.4.1 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2025-10-15 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2025-62370, GHSA-pgp9-98jm-wwq2 |
| Affected functions | alloy_dyn_abi::eip712::Resolver::encode_type |
What to do
- See which version you have:
cargo tree -i alloy-dyn-abi(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p alloy-dyn-abi. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplealloy-dyn-abi = "1.4.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
An uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash().
Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.
The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.
Reported by Christian Reitter & Zeke Mostov from Turnkey.
References
- Package: crates.io/crates/alloy-dyn-abi
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0073.html
- Web: github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?