Loading...
Skip to main content
GeekWala

CVE-2021-29511 — Memory over-allocation in evm-core — CVE Details

MEDIUM

Memory over-allocation in evm crate

Published January 30, 2024Updated July 8, 2026Source: osv

Summary

### Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. ### Patches The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. ### Workarounds None. Please upgrade your `evm` crate version ### References Fix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd ### For more information If you have any questions or comments about this advisory: * Open an issue in [evm repo](https://github.com/rust-blockchain/evm) * Email [Wei](mailto:wei@that.world)

Advisory Timeline

  • First published January 30, 2024 (986 days ago).
  • Last revised July 8, 2026 — 889 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update evm-core to 0.25.1 or later
cargo update -p evm-core --precise 0.25.1
Cargo
Update evm to 0.24.1 or later
cargo update -p evm --precise 0.24.1
Cargo
Update evm-core to 0.21.1 or later
cargo update -p evm-core --precise 0.21.1
Cargo
Update evm-core to 0.23.1 or later
cargo update -p evm-core --precise 0.23.1
Cargo
Update evm-core to 0.22.1 or later
cargo update -p evm-core --precise 0.22.1
Cargo
Update evm to 0.22.1 or later
cargo update -p evm --precise 0.22.1
Cargo
Update evm-core to 0.26.1 or later
cargo update -p evm-core --precise 0.26.1
Cargo
Update evm to 0.26.1 or later
cargo update -p evm --precise 0.26.1
Cargo
Update evm to 0.25.1 or later
cargo update -p evm --precise 0.25.1
Cargo
Update evm to 0.23.1 or later
cargo update -p evm --precise 0.23.1
Cargo
Update evm-core to 0.24.1 or later
cargo update -p evm-core --precise 0.24.1
Cargo
Update evm to 0.21.1 or later
cargo update -p evm --precise 0.21.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (12)

Affects 1 ecosystem: crates.io (2).

PackageEcosystemAffectedFixed In
evm-core
crates.io
0.25.00.25.1
evm
crates.io
0.24.00.24.1
evm-core
crates.io
All versions0.21.1
evm-core
crates.io
0.23.00.23.1
evm-core
crates.io
0.22.00.22.1
evm
crates.io
0.22.00.22.1
evm-core
crates.io
0.26.00.26.1
evm
crates.io
0.26.00.26.1
evm
crates.io
0.25.00.25.1
evm
crates.io
0.23.00.23.1
evm-core
crates.io
0.24.00.24.1
evm
crates.io
All versions0.21.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-770
    Allocation of Resources Without LimitsMITRE
  • CWE-787
    Out-of-bounds WriteMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2021-29511?
Memory over-allocation in evm crate This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2021-29511?
CVE-2021-29511 affects evm-core and evm. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-29511 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-4jwq-572w-4388

Related CVEs

  • CVE-2021-41153
    HIGH

    Specification non-compliance in JUMPI

  • CVE-2026-102821
    MEDIUM

    Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

  • CVE-2026-102820
    MEDIUM

    pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies