← All advisories

High severity7.5NVD Advisory· Published Aug 19, 2024· Updated Jun 17, 2026

CVE-2024-44073

CVE-2024-44073

Description

The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
miniscriptcrates.io	>= 12.0.0, < 12.2.0	12.2.0
miniscriptcrates.io	>= 11.0.0, < 11.2.0	11.2.0
miniscriptcrates.io	>= 10.0.0, < 10.2.0	10.2.0
miniscriptcrates.io	< 9.2.0	9.2.0

Affected products

3

ghsa-coords
pkg:cargo/miniscript
Range: >= 12.0.0, < 12.2.0
Rust Bitcoin/Miniscript
cpe:2.3:a:rust-bitcoin:miniscript:*:*:*:*:*:rust:*:*
Range: <12.2.0
Miniscript/rust-miniscriptcpe-rescue

Patches

Vulnerability mechanics

References

11

github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0nvdPatchWEB
github.com/rust-bitcoin/rust-miniscript/pull/704nvdIssue TrackingPatchWEB
github.com/rust-bitcoin/rust-miniscript/pull/712nvdIssue TrackingPatchWEB
github.com/advisories/GHSA-rv9v-r4vm-gj8xghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-44073ghsaADVISORY
github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575bghsaWEB
github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151ghsaWEB
github.com/rust-bitcoin/rust-miniscript/pull/712/filesghsaWEB
github.com/rust-bitcoin/rust-miniscript/pull/713/filesghsaWEB
github.com/rust-bitcoin/rust-miniscript/pull/714/filesghsaWEB
github.com/rust-bitcoin/rust-miniscript/pull/715/filesghsaWEB

News mentions

0

No linked articles in our index yet.