Dfinity vulnerabilities
We track 3 vulnerabilities in Dfinity products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 5, 2024.
Latest Dfinity vulnerabilities
- 7.5 High severity
ic-cdk: Missing Release of Memory after Effective Lifetime
When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the pol
- 7.5 High severity
ic-stable-structures: Missing Release of Memory after Effective Lifetime
When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain
- 9.1 Critical severity
agent-js: Use of Insufficiently Random Values
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the lib