CVE-2021-29511: evm project evm

csirt@kutim:~/threat-intel/cve/CVE-2021-29511

CVSS 6.5 · Medium EPSS 1,3%

Kerentanan Allocation of Resources Without Limits or Throttling pada evm project evm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version.

Rincian

Terbit di NVD: 12 Mei 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
evm project	evm	Semua versi hingga 0.21.0
evm project	evm	Versi 0.22.0
evm project	evm	Versi 0.23.0
evm project	evm	Versi 0.24.0
evm project	evm	Versi 0.25.0
evm project	evm	Versi 0.26.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd patch · advisory pihak ketiga
https://github.com/rust-blockchain/evm/security/advisories/GHSA-4jwq-572w-4388 patch · advisory pihak ketiga
https://crates.io/crates/evm advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.