{"id":"GHSA-773q-5334-5gf9","aliases":["RUSTSEC-2021-0066"],"status":"published","title":"Memory over-allocation in evm-core","description":"Prior to the patch, when executing specific EVM opcodes related\nto memory operations that use `evm_core::Memory::copy_large`, the\ncrate can over-allocate memory when it is not needed, making it\npossible for an attacker to perform denial-of-service attack.\n\nThe flaw was corrected in commit `19ade85`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2021-05-11T12:00:00Z","modified":"2023-11-08T04:16:40Z","fixes":[{"ecosystem":"crates.io","package":"evm-core","fixed_in":["0.26.1","0.25.1","0.24.1","0.23.1","0.21.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0"},{"fixed":"0.26.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"0.24.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.25.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.24.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.23.0"},{"fixed":"0.23.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"evm-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.21.1"},{"introduced":"0.22.0-0"},{"fixed":"0.23.1"},{"introduced":"0.24.0-0"},{"fixed":"0.24.1"},{"introduced":"0.25.0-0"},{"fixed":"0.25.1"},{"introduced":"0.26.0-0"},{"fixed":"0.26.1"}]}]}],"references":[{"url":"https://github.com/rust-blockchain/evm/commit/19ade85","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0066.html","tags":["web","advisory"]},{"url":"https://github.com/rust-blockchain/evm","tags":["package","web"]},{"url":"https://github.com/advisories/GHSA-773q-5334-5gf9"},{"url":"https://crates.io/crates/evm-core","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-773q-5334-5gf9","title":"Memory over-allocation in evm-core","description":"Prior to the patch, when executing specific EVM opcodes related\nto memory operations that use `evm_core::Memory::copy_large`, the\ncrate can over-allocate memory when it is not needed, making it\npossible for an attacker to perform denial-of-service attack.\n\nThe flaw was corrected in commit `19ade85`.\n","status":"published","published":"2021-08-25T20:55:36Z","modified":"2023-06-13T17:20:08Z","cwes":["CWE-789"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"osv":[{"id":"GHSA-773q-5334-5gf9","title":"Memory over-allocation in evm-core","description":"Prior to the patch, when executing specific EVM opcodes related\nto memory operations that use `evm_core::Memory::copy_large`, the\ncrate can over-allocate memory when it is not needed, making it\npossible for an attacker to perform denial-of-service attack.\n\nThe flaw was corrected in commit `19ade85`.\n","status":"published","published":"2021-08-25T20:55:36Z","modified":"2023-11-08T04:16:40.750878Z","cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"RUSTSEC-2021-0066","title":"Denial of service on EVM execution due to memory over-allocation","description":"Prior to the patch, when executing specific EVM opcodes related\nto memory operations that use `evm_core::Memory::copy_large`, the\ncrate can over-allocate memory when it is not needed, making it\npossible for an attacker to perform denial-of-service attack.\n\nThe flaw was corrected in commit `19ade85`.","status":"published","published":"2021-05-11T12:00:00Z","modified":"2023-11-08T04:16:40.750878Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}