Internet Computer vulnerabilities
We track 4 vulnerabilities in Internet Computer products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 5, 2024.
Latest Internet Computer vulnerabilities
- 7.5 High severity
ic-cdk: Missing Release of Memory after Effective Lifetime
When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the pol
- 7.5 High severity
ic-stable-structures: Missing Release of Memory after Effective Lifetime
When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain
- 9.1 Critical severity
agent-js: Use of Insufficiently Random Values
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the lib
- 7.5 High severity
Candid: Loop with Unreachable Exit Condition
The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as