CVE-2024-30253

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

State: Published
Severity: 7.5 High
Published: Apr 17, 2024
Updated: Aug 21, 2024
Reserved: Mar 26, 2024

Description

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products

Product	Versions
solana-web3.jssolana-labs	>= 1.91.0, < 1.91.3Affected >= 1.90, < 1.90.2Affected >= 1.89, < 1.89.2Affected = 1.88.0Affected >=1.87.0, < 1.87.7Affected = 1.86.0Affected = 1.85.0Affected = 1.84.0Affected = 1.83.0Affected = 1.82.0Affected = 1.81.0Affected = 1.80.0Affected = 1.79.0Affected >= 1.78, < 1.78.8Affected >= 1.77, < 1.77.4Affected = 1.76.0Affected = 1.75.0Affected = 1.74.0Affected >= 1.73.0, < 1.73.5Affected = 1.72.0Affected = 1.71.0Affected >= 1.70.0, < 1.70.4Affected = 1.69.0Affected >= 1.68.0, < 1.68.2Affected >= 1.67.0, < 1.67.3Affected and 67 more versions

Product

Versions

solana-web3.jssolana-labs

>= 1.91.0, < 1.91.3Affected
>= 1.90, < 1.90.2Affected
>= 1.89, < 1.89.2Affected
= 1.88.0Affected
>=1.87.0, < 1.87.7Affected
= 1.86.0Affected
= 1.85.0Affected
= 1.84.0Affected
= 1.83.0Affected
= 1.82.0Affected
= 1.81.0Affected
= 1.80.0Affected
= 1.79.0Affected
>= 1.78, < 1.78.8Affected
>= 1.77, < 1.77.4Affected
= 1.76.0Affected
= 1.75.0Affected
= 1.74.0Affected
>= 1.73.0, < 1.73.5Affected
= 1.72.0Affected
= 1.71.0Affected
>= 1.70.0, < 1.70.4Affected
= 1.69.0Affected
>= 1.68.0, < 1.68.2Affected
>= 1.67.0, < 1.67.3Affected
and 67 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.