eth-abi is vulnerable to recursive DoS
Description
A recursive denial-of-service (DoS) vulnerability exists in the eth-abi Python package due to a recursive pointer issue during decoding of nested dynamic arrays. This flaw can cause an OverflowError by triggering excessive recursion or memory exhaustion when decoding crafted payloads. The vulnerability affects eth-abi versions prior to 5.0.1 and has been assigned a moderate severity level. A patch is available to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eth-abi package is vulnerable to a recursive DoS caused by improper handling of deeply nested dynamic arrays during decoding. Specifically, the vulnerability arises from a recursive pointer issue that leads to excessive recursion depth or integer overflow errors when decoding specially crafted payloads. This can cause the Python process to crash or become unresponsive. The issue is distinct from but related to previous zero-sized type (ZST) vulnerabilities. The affected versions are all versions before 5.0.1. The vulnerability is tracked as GHSA-3qwc-47jf-5rf7 and CWE-1285.
Potential Impact
Successful exploitation of this vulnerability can cause denial of service by crashing or hanging the application using eth-abi for decoding. There is no indication of code execution or data corruption beyond service disruption. No known exploits are reported in the wild.
Mitigation Recommendations
An official patch is available in eth-abi version 5.0.1 and later. Users should upgrade to version 5.0.1 or newer to remediate this vulnerability. No additional mitigation steps are required once the package is updated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3qwc-47jf-5rf7
- Osv Schema Version
- 1.4.0
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
Threat ID: 6a9845c0acd9273b496ae90d
Added to database: 09/02/2026, 15:50:24 UTC
Last enriched: 09/07/2026, 21:08:03 UTC
Last updated: 10/04/2026, 06:16:18 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.