CVE-2024-30253: Handling untrusted input can result in a crash, leading to loss of availability / denial of service

DescriptionCVE.org

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.

• solana-labs · solana-web3.js>= 1.91.0, < 1.91.3; >= 1.90, < 1.90.2; >= 1.89, < 1.89.2; = 1.88.0; >=1.87.0, < 1.87.7; = 1.86.0 and 86 more

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Memory Buffer Bounds · Memory Corruption

Vendor

solana-labs

Published

April 2024

Band

Unlikely (under 1%), April 2024

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-119cwe.mitre.org
• github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8github.com
• github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b2github.com