{"id":"CVE-2024-30253","aliases":["GHSA-8m45-2rjm-j347"],"url":"https://o3.security/vulnerability/CVE-2024-30253","summary":"Handling untrusted input can result in a crash, leading to loss of availability / denial of service","details":"@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.","published":"2024-04-17T15:07:27.546Z","modified":"2026-08-12T03:51:38.820342365Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.91.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.90.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.89.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.88.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.87.7"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.86.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.85.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.84.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.83.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.82.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.81.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.80.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.79.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.78.8"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.77.4"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.76.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.75.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.74.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.73.5"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.72.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.71.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.70.4"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.69.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.68.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.67.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.66.6"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.65.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.64.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.63.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.62.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.61.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.60.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.59.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.58.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.57.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.56.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.55.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.54.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.53.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.52.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.51.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.50.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.49.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.48.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.47.5"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.46.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.45.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.44.4"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.43.7"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.42.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.41.11"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.40.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.39.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.38.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.37.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.36.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.35.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.34.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.33.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.32.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.31.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.30.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.29.4"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.28.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.27.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.26.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.25.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.24.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.23.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.22.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.21.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.20.3"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.19.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.18.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.17.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.16.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.15.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.14.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.13.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.12.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.11.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.10.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.9.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.8.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.7.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.6.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.5.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.4.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.3.1"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.2.8"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.1.2"},{"ecosystem":"npm","name":"@solana/web3.js","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0","label":"solana-labs/solana-web3.js@77d9352"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30253.json"},{"type":"ADVISORY","url":"https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8m45-2rjm-j347"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30253"},{"type":"FIX","url":"https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0"},{"type":"PACKAGE","url":"https://github.com/solana-labs/solana-web3.js"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.820342365Z"}}