GHSA-xc76-5pf9-mx8m

Source

https://github.com/advisories/GHSA-xc76-5pf9-mx8m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-xc76-5pf9-mx8m/GHSA-xc76-5pf9-mx8m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xc76-5pf9-mx8m

Aliases

CVE-2025-29776

Published

2025-03-14T17:31:07Z

Modified

2025-03-15T20:47:15Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L CVSS Calculator

Summary

In Azle, calling `setTimer` causes infinite loop of timers

Details

Impact

Calling setTimer in Azle versions 0.27.0, 0.28.0, and 0.29.0 causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer.

The infinite loop will occur with any valid invocation of setTimer.

Patches

The problem has been fixed as of Azle version 0.30.0.

Workarounds

If a canister is caught in this infinite loop after calling setTimer, the canister can be upgraded and the timers will all be cleared, thus ending the loop.

Database specific

{
    "cwe_ids": [
        "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-14T17:31:07Z",
    "nvd_published_at": "2025-03-14T14:15:18Z",
    "severity": "HIGH"
}

References

Affected packages

npm / azle

Package

Name: azle; View open source insights on deps.dev
Purl: pkg:npm/azle

Affected ranges

Type: SEMVER
Events: Introduced

0.27.0

Fixed

0.30.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-xc76-5pf9-mx8m/GHSA-xc76-5pf9-mx8m.json"