Skip to content
OpenAdvisories
High · 7.5 CVE-2024-44073 EUVD-2024-2654GHSA-rv9v-r4vm-gj8x

Miniscript allows stack consumption

Published Aug 19, 2024 · Updated Sep 13, 2024 · Assigned by mitre

Package: miniscript Ecosystem: crates.io

Description

The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io miniscript >= 12.0.0, < 12.2.0 12.2.0 GHSA-rv9v-r4vm-gj8x
crates.io miniscript >= 11.0.0, < 11.2.0 11.2.0 GHSA-rv9v-r4vm-gj8x
crates.io miniscript >= 10.0.0, < 10.2.0 10.2.0 GHSA-rv9v-r4vm-gj8x
crates.io miniscript < 9.2.0 9.2.0 GHSA-rv9v-r4vm-gj8x

References