{"action":"Upgrade ic_cdk to 0.8.2 or later.","affected":[{"fixed":"0.8.2","introduced":"0.8.0"},{"fixed":"0.9.3","introduced":"0.9.0"},{"fixed":"0.10.1","introduced":"0.10.0"},{"fixed":"0.11.6","introduced":"0.11.0"},{"fixed":"0.12.2","introduced":"0.12.0"},{"fixed":"0.13.5","introduced":"0.13.0"},{"fixed":"0.14.1","introduced":"0.14.0"},{"fixed":"0.15.1","introduced":"0.15.0"}],"component":"ic_cdk","cve_ids":["CVE-2024-7884"],"ecosystem":"crates.io","epss":0.00693,"exploited":false,"fixed_versions":["0.8.2","0.9.3","0.10.1","0.11.6","0.12.2","0.13.5","0.14.1","0.15.1"],"ghsa_id":"GHSA-rwq6-crjg-9cpw","id":"tcs_01M5KF38MH86NFE5437H74X2WK","modified_at":"2024-09-09T14:05:39Z","published_at":"2024-09-05T16:44:27Z","references":["https://osv.dev/vulnerability/GHSA-rwq6-crjg-9cpw","https://github.com/dfinity/cdk-rs/security/advisories/GHSA-rwq6-crjg-9cpw","https://nvd.nist.gov/vuln/detail/CVE-2024-7884","https://github.com/dfinity/cdk-rs/pull/509","https://github.com/dfinity/cdk-rs/commit/bd17d57a7b8ca59665fea5fad6143ca02724d03b","https://docs.rs/ic-cdk/latest/ic_cdk","https://github.com/dfinity/cdk-rs","https://internetcomputer.org/docs/current/references/ic-interface-spec","https://rustsec.org/advisories/RUSTSEC-2024-0372.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-rwq6-crjg-9cpw","url":"https://osv.dev/vulnerability/GHSA-rwq6-crjg-9cpw"}],"summary":"ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`"}