CVE-2025-62370: alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

October 15, 2025

An uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash().

Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.

References

crates.io/crates/alloy-dyn-abi/0.8.26
crates.io/crates/alloy-dyn-abi/1.4.1
github.com/advisories/GHSA-pgp9-98jm-wwq2
github.com/alloy-rs/core
github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2
nvd.nist.gov/vuln/detail/CVE-2025-62370
rustsec.org/advisories/RUSTSEC-2025-0073.html

Code Behaviors & Features

Detect and mitigate CVE-2025-62370 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →