PT-2025-11265
CVE-2025-29776
·
Published
2025-03-14
·
Updated
2025-03-14
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions:
Azle versions 0.27.0 through 0.29.0
Description:
The issue arises when calling
setTimer in the affected Azle versions, resulting in an immediate infinite loop of timers. Each timer attempts to clean up the global state of the previous timer. This loop occurs with any valid invocation of setTimer.Recommendations:
For versions 0.27.0 through 0.29.0, upgrade to version 0.30.0 to fix the issue.
As a temporary workaround for canisters caught in the infinite loop after calling
setTimer, consider upgrading the canister to clear timers and end the loop. Found an issue in the description? Have something to add? Feel free to write us 👾