7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62370

CVE-2025-62370: alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

Impact

An uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash().

Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.

Patches

The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.

Workarounds

There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.

Reported by

Christian Reitter & Zeke Mostov from Turnkey

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62370

CVE-2025-62370:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
alloy-dyn-abi	rust	< 0.8.26	0.8.26
alloy-dyn-abi	rust	>= 1.0.0, < 1.4.1	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in the alloy-dyn-abi Rust library, caused by an uncaught panic when hashing a malformed EIP-712 TypedData structure. The root cause lies within the alloy_dyn_abi::eip712::resolver::Resolver::encode_type function. This function processes type definitions, and for certain malformed inputs, it would attempt to access the first element of an empty vector using .unwrap(), which triggers a panic.

The security advisory and the patch commit 7823e9af8c20e9fcfb5360f5eafd891c457ebccf make it clear that the panic occurs when linearize returns an empty set of types. The fix involves adding a check to ensure this vector is not empty before proceeding.

The entry point for this vulnerability is the alloy_dyn_abi::eip712::TypedData::eip712_signing_hash function. This is the user-facing function that takes the TypedData as input. During its execution, it calls the vulnerable encode_type function, leading to the crash. Therefore, both eip712_signing_hash and encode_type are key functions that would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.