alloy-dyn-abi CVE-2025-62370

Exploitation requires the affected application to invoke alloy_dyn_abi::TypedData::eip712_signing_hash() (or the EIP-712 encode/resolve path) on attacker-influenced input where the primaryType resolves to an empty linearized type list - e.g., a primaryType that is a basic Solidity type or uses the enum-hack '.' syntax, so try_as_basic_solidity skips it leaving no linearized types. The practical limiting factor is reachability: the alloy-dyn-abi crate is a library, not a listening service, so AV:N only holds when a wallet, signing service, or RPC frontend deserializes untrusted EIP-712 TypedData and hashes it. Affected versions are < 0.8.26 and >= 1.0.0, < 1.4.1; no authentication, user interaction, or special runtime configuration is otherwise required, and there is no known workaround other than upgrading.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) reflects a purely availability-impacting DoS - note C:N/I:N, so there is no confidentiality or integrity loss despite the input 'Information Disclosure' tag (which contradicts the vector and appears mislabeled). EPSS is low at 0.45% (37th percentile), consistent with there being no CISA KEV listing and no public exploit identified at time of analysis; all signals agree this is a low-likelihood, low-blast-radius issue rather than a mass-exploitation priority. The CWE-248 (uncaught exception/panic) root cause is confirmed by the vendor advisory and the one-line patch (an is_empty() guard before indexing). The real caveat is that 'AV:N / PR:N' only applies if the consuming application actually feeds attacker-controlled EIP-712 TypedData into eip712_signing_hash() over the network - the library itself is not a listening service, so true network reachability is application-dependent. Prioritize patching for services that hash untrusted typed-data (wallets, signing relays, RPC frontends); deprioritize for offline or trusted-input usage.

An attacker sends a crafted EIP-712 TypedData payload (e.g., a primaryType that linearizes to an empty type list, such as a bare Solidity base type or empty custom type) to a network service that calls alloy_dyn_abi::TypedData::eip712_signing_hash() on untrusted input. The malformed input triggers an uncaught Rust panic, crashing the worker or process and denying service; repeated requests sustain the outage. No public exploit identified at time of analysis, though the patch's regression tests effectively document the triggering inputs.