zaino-state Rust Crate Vulnerability: Infinite Loop Risk
The zaino-state Rust crate reportedly has an unbounded async function that can lead to infinite loops and high CPU usage due to lack of recursion depth limit and cycle detection.
What happened
An early warning has been issued regarding a vulnerability in the zaino-state Rust crate. The crate contains a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. This function lacks a recursion depth limit and cycle detection, which can result in an infinite loop and consume 100% CPU. The issue appears to affect all versions of the crate introduced from version 0, with a fix available in version 0.4.1.
Professional software engineers using the zaino-state crate are advised to monitor for updates that address the identified issues. As a precautionary measure, consider implementing additional checks or limits in your usage of the zaino-state crate to mitigate potential risks. The primary source for this vulnerability is the GitHub Security Advisory [GHSA-3whf-vgf2-9w6g](https://github.com/zingolabs/zaino/security/advisories/GHSA-3whf-vgf2-9w6g). For the most accurate and up-to-date information, consult the primary sources.
How 0Day mitigates this
zaino-state is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.