Internet Computer

Products

ProductCVEsExploitedLatest
agent-js1–Feb 21, 2024
Candid1–Dec 8, 2023
ic-cdk1–Sep 5, 2024
ic-stable-structures1–May 21, 2024
Motoko1–Dec 9, 2024

Exploited and recent CVEs

  • CVE-2024-11991 Medium 5.6 Uninitialized memory access in Motoko incremental garbage collector 0.2%
  • CVE-2024-7884 High 7.5 Memory leak when calling a canister method via `ic_cdk::call` 0.7%
  • CVE-2024-4435 Medium 5.9 BTreeMap memory leak when deallocating nodes with overflows 0.5%
  • CVE-2024-1631 Critical 9.1 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` 0.9%
  • CVE-2023-6245 High 7.5 Infinite decoding loop through specially crafted payload 1.2%