{"action":"Upgrade candid to 0.9.10 or later.","affected":[{"fixed":"0.9.10","introduced":"0.9.0"}],"component":"candid","cve_ids":["CVE-2023-6245"],"ecosystem":"crates.io","epss":0.01212,"exploited":false,"fixed_versions":["0.9.10"],"ghsa_id":"GHSA-7787-p7x6-fq3j","id":"tcs_01M5KEV2RT1X45CNQQA19K9YCC","modified_at":"2026-05-04T09:00:06.810494171Z","published_at":"2023-12-08T15:23:22Z","references":["https://osv.dev/vulnerability/GHSA-7787-p7x6-fq3j","https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j","https://nvd.nist.gov/vuln/detail/CVE-2023-6245","https://github.com/dfinity/candid/pull/478","https://github.com/dfinity/candid/commit/b233dbc2d2bcc79c9fc574dd5968269df680b073","https://github.com/dfinity/candid","https://github.com/dfinity/candid/blob/master/spec/Candid.md","https://internetcomputer.org/docs/current/references/candid-ref","https://internetcomputer.org/docs/current/references/ic-interface-spec","https://rustsec.org/advisories/RUSTSEC-2023-0073.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7787-p7x6-fq3j","url":"https://osv.dev/vulnerability/GHSA-7787-p7x6-fq3j"}],"summary":"Candid infinite decoding loop through specially crafted payload"}