{"cve":"CVE-2023-6245","nvd":{"published":"2023-12-08T15:15:08.233","modified":"2026-06-17T06:50:23.063","status":"Modified","description":"The Candid library causes a Denial of Service while \nparsing a specially crafted payload with 'empty' data type. For example,\n if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type.  The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop.\n\n\nCanisters using affected versions of candid\n are exposed to denial of service by causing the decoding to run \nindefinitely until the canister traps due to reaching maximum \ninstruction limit per execution round. Repeated exposure to the payload \nwill result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835","CWE-20","CWE-168","CWE-1288"],"references":["https://github.com/dfinity/candid/blob/master/spec/Candid.md","https://github.com/dfinity/candid/pull/478","https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j","https://internetcomputer.org/docs/current/references/candid-ref","https://internetcomputer.org/docs/current/references/ic-interface-spec"],"products":["dfinity:candid"],"source":"nvd","synced_at":"2026-10-19T21:42:34.585441961+00:00"},"epss":{"cve":"CVE-2023-6245","score":0.01212,"percentile":0.68504,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7787-p7x6-fq3j","url":"https://osv.dev/vulnerability/GHSA-7787-p7x6-fq3j","summary":"Candid infinite decoding loop through specially crafted payload","modified":"2026-05-04T09:00:06.810494171Z","packages":[{"ecosystem":"crates.io","name":"candid","purl":"pkg:cargo/candid","ranges":[">=0.9.0 <0.9.10"],"fixed":["0.9.10"]}]},{"id":"RUSTSEC-2023-0073","url":"https://osv.dev/vulnerability/RUSTSEC-2023-0073","summary":"Infinite decoding loop through specially crafted payload","modified":"2023-12-09T10:26:19.388920Z","packages":[{"ecosystem":"crates.io","name":"candid","purl":"pkg:cargo/candid","ranges":[">=0.9.0 <0.9.10"],"fixed":["0.9.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}