Executive brief
Solana web3.js is a JavaScript library used by blockchain applications to interact with the Solana network. Attackers can send specially crafted input that causes applications using vulnerable versions to consume excessive memory and crash, resulting in service unavailability. This affects any application or service that processes untrusted input with the affected library, including servers, clients, mobile apps, and desktop applications.
Technical details
The vulnerability is a memory exhaustion (CWE-119) issue in @solana/web3.js versions 1.86.0 through 1.91.2. Specific malicious inputs can trigger unbounded memory allocation within the library, leading to out-of-memory (OOM) conditions. The attack requires no authentication or user interaction and is triggered entirely via network input processing. Affected applications will crash when processing the crafted input, causing denial of service. Patches are available across multiple affected version branches (e.g., 1.91.3, 1.90.2, 1.89.2, 1.88.1, and earlier patched releases).
Affected products
- Solana Foundation web3.js 1.86.0 through 1.91.2
Timeline
- 2024-04-17: disclosed
- 2024-04-17: patched