CVE-2021-29511
Memory over-allocation in evm crate
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1. There are no workarounds. Please upgrade your evm crate version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Memory over-allocation in evm crate
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1. There are no workarounds. Please upgrade your evm crate version.
- Record
CVE-2021-29511- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2024-0247
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1. There are no workarounds. Please upgrade your evm crate version.
- Record
EUVD-2024-0247- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jwq-572w-4388
Memory over-allocation in evm crate
Impact
Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack.
Patches
The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1.
Workarounds
None. Please upgrade your evm crate version
References
Fix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-4jwq-572w-4388- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-787
- Updated
- 2026-11-02
NVD
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1. There are no workarounds. Please upgrade your evm crate version.
- Record
CVE-2021-29511- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-770, CWE-787
- Updated
- 2026-11-02
OSV
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1. There are no workarounds. Please upgrade your evm crate version.
- Record
CVE-2021-29511- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-4jwq-572w-4388
Memory over-allocation in evm crate
Impact
Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack.
Patches
The flaw was corrected in commit 19ade85. Users should upgrade to ==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1.
Workarounds
None. Please upgrade your evm crate version
References
Fix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-4jwq-572w-4388- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-787
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
evmcrates.io |
through 0.21.0 | 0.21.1 |
evm-corecrates.io |
through 0.21.0 | 0.21.1 |
evmcrates.io |
0.22.0 to 0.22.0 | 0.22.1 |
evmcrates.io |
0.23.0 to 0.23.0 | 0.23.1 |
evmcrates.io |
0.24.0 to 0.24.0 | 0.24.1 |
evmcrates.io |
0.25.0 to 0.25.0 | 0.25.1 |
evmcrates.io |
0.26.0 to 0.26.0 | 0.26.1 |
evm-corecrates.io |
0.22.0 to 0.22.0 | 0.22.1 |
evm-corecrates.io |
0.23.0 to 0.23.0 | 0.23.1 |
evm-corecrates.io |
0.24.0 to 0.24.0 | 0.24.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
evm-corecrates.io |
0.25.0 to 0.25.0 | 0.25.1 |
evm-corecrates.io |
0.26.0 to 0.26.0 | 0.26.1 |
evmcrates.io |
before 0.21.1 | 0.21.1 |
evm-corecrates.io |
before 0.21.1 | 0.21.1 |
evmcrates.io |
0.22.0 up to 0.22.1 | 0.22.1 |
evmcrates.io |
0.23.0 up to 0.23.1 | 0.23.1 |
evmcrates.io |
0.24.0 up to 0.24.1 | 0.24.1 |
evmcrates.io |
0.25.0 up to 0.25.1 | 0.25.1 |
evmcrates.io |
0.26.0 up to 0.26.1 | 0.26.1 |
evm-corecrates.io |
0.22.0 up to 0.22.1 | 0.22.1 |
evm-corecrates.io |
0.23.0 up to 0.23.1 | 0.23.1 |
evm-corecrates.io |
0.24.0 up to 0.24.1 | 0.24.1 |
evm-corecrates.io |
0.25.0 up to 0.25.1 | 0.25.1 |
evm-corecrates.io |
0.26.0 up to 0.26.1 | 0.26.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29511 is a medium vulnerability (CVSS 6.5) in Evm Project Evm, published May 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. Fixed in evm 0.21.1.