ckb (crates.io)
Advisories
30
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.102.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p ckb --precise 0.102.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory |
Medium | >= 0.38.0-rc1, < 0.38.2 | 0.38.2 |
| GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory |
Medium | >= 0.39.0-rc1, < 0.39.0 | 0.39.0 |
| GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory |
Medium | >= 0.35.0-rc1, < 0.35.2 | 0.35.2 |
| GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory |
Medium | >= 0.36.0-rc1, < 0.36.1 | 0.36.1 |
| GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory |
Medium | >= 0.37.0-rc1, < 0.37.1 | 0.37.1 |
| GHSA-h4c3-5275-vrmg Nervos CKB Pool does not remove the conflicting transactions from the statistics |
Medium | < 0.39.2 | 0.39.2 |
| GHSA-q73f-w3h7-7wcc Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result |
Critical | < 0.34.2 | 0.34.2 |
| GHSA-3gjh-29fv-8hr6 Nervos CKB Snappy decompress length can be very large and causes out of memory error |
High | < 0.34.2 | 0.34.2 |
| GHSA-wjxc-pjx9-4wvm Nervos CKB Panic on malformed input |
High | < 0.34.2 | 0.34.2 |
| GHSA-hjqq-29pw-96wj Nervos CKB node panics when processing a block which parent timestamp is too new |
High | >= 0.34.0, < 0.34.1 | 0.34.1 |
| GHSA-hjqq-29pw-96wj Nervos CKB node panics when processing a block which parent timestamp is too new |
High | >= 0.33.0, < 0.33.2 | 0.33.2 |
| GHSA-r9rv-9mh8-pxf4 Nervos CKB BlockTimeTooNew should not be considered as invalid block |
Medium | < 0.33.1 | 0.33.1 |
| GHSA-pr39-8257-fxc2 Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP |
Low | < 0.34.0 | 0.34.0 |
| GHSA-84x2-2qv6-qg56 Nervos CKB P2P DoS Attacks |
Critical | < 0.34.0 | 0.34.0 |
| GHSA-q669-2vfg-cxcg Nervos CKB Unaligned Pointer Dereference |
Medium | < 0.31.1 | 0.31.1 |
| GHSA-p2gm-ffr3-w2xw Nervos CKB vulnerable to low-resource flood DDoS attacks through network message |
Low | < 0.101.4 | 0.101.4 |
| GHSA-fjj4-2q73-jvgc Nervos CKB calculation of program load cycles may be missed when executing in resume mode |
Low | >= 0.100.0 | No fix yet |
| GHSA-mcmr-49x3-4jqm ckb type_id script resume may randomly fail |
High | >= 0.100.0, < 0.102.0 | 0.102.0 |
| GHSA-7fw6-6mfj-g3q2 ckb: Transaction header_deps validation issue (network forking) |
Critical | < 0.101.1 | 0.101.1 |
| GHSA-9mfc-chwf-7whf ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low. |
Medium | < 0.43.3 | 0.43.3 |
| GHSA-j35p-q24r-5367 Dep Group Remote Memory Exhaustion (Denial of Service) in ckb |
High | < 0.43.1 | 0.43.1 |
| GHSA-45p7-c959-rgcm Process crashes when the cell used as DepGroup is not alive |
High EPSS 1.12% |
< 0.40.0 | 0.40.0 |
| GHSA-45p7-c959-rgcm Process crashes when the cell used as DepGroup is not alive |
High EPSS 1.12% |
< 0.40.0 | 0.40.0 |
| GHSA-2969-8hh9-57jc Allocation of Resources Without Limits or Throttling in ckb |
High EPSS 1.52% |
< 0.40.0 | 0.40.0 |
| GHSA-8gjm-h3xj-mp6w RPC call failure in ckb |
Critical EPSS 1.23% |
< 0.40.0 | 0.40.0 |
| GHSA-8gjm-h3xj-mp6w RPC call failure in ckb |
Critical EPSS 1.23% |
< 0.40.0 | 0.40.0 |
| GHSA-8gjm-h3xj-mp6w RPC call failure in ckb |
Critical EPSS 1.23% |
>= 0.0.0-0, < 0.40.0 | 0.40.0 |
| GHSA-2969-8hh9-57jc Allocation of Resources Without Limits or Throttling in ckb |
High EPSS 1.52% |
< 0.40.0 | 0.40.0 |
| GHSA-45p7-c959-rgcm Process crashes when the cell used as DepGroup is not alive |
High EPSS 1.12% |
>= 0.0.0-0, < 0.40.0 | 0.40.0 |
| GHSA-2969-8hh9-57jc Allocation of Resources Without Limits or Throttling in ckb |
High EPSS 1.52% |
>= 0.0.0-0, < 0.40.0 | 0.40.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor