Skip to content
Fencer Vulns
medium 6.5

CVE-2021-29511 json

Memory over-allocation in evm crate

published 2021-05-12 5 y ago modified 2026-07-08 4 mo ago also GHSA-4jwq-572w-4388 , EUVD-2024-0247

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version.

Patch / fix

  • crates.io evm 0.21.1, 0.22.1, 0.23.1, 0.24.1, 0.25.1, 0.26.1
  • crates.io evm-core 0.21.1, 0.22.1, 0.23.1, 0.24.1, 0.25.1, 0.26.1

Exploit prediction

1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io evm
<0.21.1
>=0.22.0, <0.22.1
>=0.23.0, <0.23.1
>=0.24.0, <0.24.1
>=0.25.0, <0.25.1
>=0.26.0, <0.26.1
0.21.1
0.22.1
0.23.1
0.24.1
0.25.1
0.26.1
crates.io evm-core
<0.21.1
>=0.22.0, <0.22.1
>=0.23.0, <0.23.1
>=0.24.0, <0.24.1
>=0.25.0, <0.25.1
>=0.26.0, <0.26.1
0.21.1
0.22.1
0.23.1
0.24.1
0.25.1
0.26.1

Affected products

  • rust-blockchain evm

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.