CVE-2025-62370: Alloy Core Rust Libraries DoS Vulnerability

CVE-2025-62370 Overview

CVE-2025-62370 is a denial-of-service vulnerability in the Alloy Core libraries, which form the foundation of the Rust Ethereum ecosystem. The flaw resides in the alloy_dyn_abi::TypedData component, where malformed input passed to eip712_signing_hash() triggers an uncaught panic. Attackers can submit crafted EIP-712 typed data to terminate the process and disrupt service availability. The vulnerability is tracked under [CWE-248] (Uncaught Exception) and affects versions prior to 0.8.26 and 1.4.1. Software with high availability requirements, such as network services and Ethereum-facing infrastructure, is particularly impacted.

Critical Impact
Remote unauthenticated attackers can send malformed EIP-712 typed data to crash applications using affected Alloy Core versions, causing denial of service against Rust-based Ethereum tooling and services.

Affected Products

alloy-dyn-abi crate versions prior to 0.8.26
alloy-dyn-abi crate versions in the 1.x series prior to 1.4.1
Rust applications and services depending on Alloy Core for EIP-712 typed data processing

Discovery Timeline

2025-10-15 - CVE-2025-62370 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62370

Vulnerability Analysis

The vulnerability resides in the EIP-712 typed data resolver inside the alloy-dyn-abi crate. When an application calls eip712_signing_hash() on a TypedData value, the resolver invokes encode_type(), which calls linearize() to produce an ordered list of referenced types. The code then calls linear.first().unwrap() to access the first element. When linear is empty due to malformed input, unwrap() panics, terminating the thread or process.

Any Rust service that deserializes attacker-controlled EIP-712 payloads, such as wallet backends, transaction relayers, signing services, and Ethereum RPC gateways, can be crashed by sending a crafted TypedData JSON. Repeated requests can produce sustained outages where external supervisors do not auto-restart the process.

Root Cause

The root cause is an unchecked assumption that the linearized type list contains at least one element. The code path lacked validation that the primaryType referenced an actual entry in the types map, allowing linearize() to return an empty vector that unwrap() then dereferenced.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a malformed EIP-712 JSON document, for example one whose primaryType is missing from the types map, to any endpoint that parses it into TypedData and calls eip712_signing_hash(). The resulting panic disrupts availability.

rust

// Security patch in crates/dyn-abi/src/eip712/resolver.rs
/// <https://eips.ethereum.org/EIPS/eip-712#definition-of-encodetype>
pub fn encode_type(&self, name: &str) -> Result<String> {
    let linear = self.linearize(name)?;
+   if linear.is_empty() {
+       return Err(Error::missing_type(name));
+   }
    let first = linear.first().unwrap().eip712_encode_type();

    // Sort references by name (eip-712 encodeType spec)

Source: Alloy RS Commit 7823e9af. The patch adds an is_empty() check and returns a structured Error::missing_type instead of panicking.

Detection Methods for CVE-2025-62370

Indicators of Compromise

Unexpected process termination or thread panics in Rust services with stack traces referencing alloy_dyn_abi::eip712 or resolver::encode_type.
Log entries containing the panic message called Option::unwrap() on a None value correlated with inbound EIP-712 request handling.
Spikes in HTTP 5xx or connection-reset responses from Ethereum signing or relayer endpoints following malformed JSON submissions.

Detection Strategies

Inventory Rust binaries and services for the alloy-dyn-abi dependency using cargo audit against the RustSec Advisory RUSTSEC-2025-0073.
Inspect application logs for repeated panics tied to EIP-712 parsing, especially when correlated with inbound traffic from a single source.
Add validation at the API boundary that rejects EIP-712 payloads whose primaryType does not appear in the types map.

Monitoring Recommendations

Alert on abnormal restart counts for services exposing EIP-712 signing or hashing functionality.
Monitor request rates and error rates on /sign, /typedData, and equivalent endpoints to detect availability attacks.
Track dependency drift in CI by failing builds when alloy-dyn-abi resolves below 0.8.26 or below 1.4.1 in the 1.x line.

How to Mitigate CVE-2025-62370

Immediate Actions Required

Upgrade alloy-dyn-abi to version 1.4.1 for projects on the 1.x release line, or to 0.8.26 for projects on the 0.8.x line.
Run cargo update -p alloy-dyn-abi and rebuild dependent binaries, then redeploy production services.
Validate EIP-712 input at the application boundary before passing it to eip712_signing_hash() to reject payloads with unknown primaryType values.

Patch Information

The fix was committed in Alloy RS commit 7823e9af and released as alloy-dyn-abi 1.4.1. The change is backported to alloy-dyn-abi 0.8.26. Refer to GitHub Security Advisory GHSA-pgp9-98jm-wwq2 for advisory text.

Workarounds

Wrap calls to eip712_signing_hash() in catch_unwind to convert panics into recoverable errors while patching is in progress.
Deploy a process supervisor such as systemd with Restart=always and rate limiting to reduce the impact of repeated panic-induced restarts.
Apply schema validation at ingress so that EIP-712 documents missing a valid primaryType definition are rejected before reaching the vulnerable code path.

bash

# Configuration example: pin patched alloy-dyn-abi versions in Cargo.toml
[dependencies]
alloy-dyn-abi = "1.4.1"
# Or, for projects on the 0.8.x line:
# alloy-dyn-abi = "0.8.26"

# Verify resolved version and audit for known advisories
cargo update -p alloy-dyn-abi
cargo tree -i alloy-dyn-abi
cargo audit