https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:26:04.055616+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-255163 EUVD-2026-255163 2026-10-08T16:26:04.058592+00:00 EUVD-2026-255163 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62370 fkie_cve-2025-62370 2026-10-08T16:26:04.058626+00:00

Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.

 https://cve.radiocsirt.org/vuln/ghsa-pgp9-98jm-wwq2 GHSA-pgp9-98jm-wwq2 — alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing 2026-10-08T16:26:04.058669+00:00

Affected: crates.io: alloy-dyn-abi

### Impact

An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`.

Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.

### Patches

The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version [`v1.4.1`](https://crates.io/crates/alloy-dyn-abi/1.4.1) and backported to [`v0.8.26`](https://crates.io/crates/alloy-dyn-abi/0.8.26).

### Workarounds

There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.

### Reported by

Christian Reitter & Zeke Mostov from [Turnkey](https://www.turnkey.com/)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15652-1 openSUSE-SU-2025:15652-1 — cargo-audit-advisory-db-20251021-1.1 on GA media 2026-10-08T16:26:04.058705+00:00

cargo-audit-advisory-db-20251021-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rustsec-2025-0073 RUSTSEC-2025-0073 — DoS vulnerability on `alloy_dyn_abi::TypedData` hashing 2026-10-08T16:26:04.058724+00:00

Affected: crates.io: alloy-dyn-abi

An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`.

Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.

The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version [v1.4.1](https://crates.io/crates/alloy-dyn-abi/1.4.1) and backported to [v0.8.26](https://crates.io/crates/alloy-dyn-abi/0.8.26).

There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.

Reported by [Christian Reitter](https://github.com/cr-tk) & [Zeke Mostov](https://github.com/emostov) from [Turnkey](https://www.turnkey.com/).