Dfinity

5 CVEs across 5 Dfinity products. Browse Dfinity vulnerabilities, severities, and proof-of-concept exploits.

Dfinity products with known CVEs

ProductCVEs
Candid1
Canister Developer Kit For The Internet Computer1
Icp-Js-Core1
Motoko1
Stable Structures1
Dfinity CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-11991Medium5.62024-12-09Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vu…
CVE-2024-7884High7.52024-09-05When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internal…
CVE-2024-4435Medium5.92024-05-21When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a nod…
CVE-2024-1631Critical9.12024-02-21Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w…
CVE-2023-6245High7.52023-12-08The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { *…