{"id":"CVE-2024-44073","aliases":["GHSA-rv9v-r4vm-gj8x"],"url":"https://o3.security/vulnerability/CVE-2024-44073","summary":"Miniscript allows stack consumption","details":"The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.","published":"2024-08-19T00:00:00Z","modified":"2026-07-15T01:49:08.149241743Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"miniscript","fixedVersion":"12.2.0"},{"ecosystem":"crates.io","name":"miniscript","fixedVersion":"11.2.0"},{"ecosystem":"crates.io","name":"miniscript","fixedVersion":"10.2.0"},{"ecosystem":"crates.io","name":"miniscript","fixedVersion":"9.2.0"}],"fix":{"url":"https://github.com/rust-bitcoin/rust-miniscript/pull/704","label":"rust-bitcoin/rust-miniscript#704"},"references":[{"type":"WEB","url":"https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/44xxx/CVE-2024-44073.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44073"},{"type":"FIX","url":"https://github.com/rust-bitcoin/rust-miniscript/pull/704"},{"type":"FIX","url":"https://github.com/rust-bitcoin/rust-miniscript/pull/712"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:08.149241743Z"}}