-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from processing Snappy-compressed data without validating the decompressed length from the header before memory allocation. The primary vulnerable function is network::compress::SnapDecoder::decompress_vec in CKB's network stack, which directly invokes the decompression routine. The underlying snappy::decompress::decompress_vec from the rust-snappy library is also vulnerable as it performs the actual buffer allocation based on the unvalidated length value extracted from the compressed stream header. These functions would appear in profiler traces when processing malicious network messages due to their direct involvement in the decompression path without safety checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ckb | rust | <= 0.34.1 | 0.34.2 |
A Semantic Attack on Google Gemini - Read the Latest Research