Candid Security Vulnerabilities - 2023

CVE-2023-6245

The Candid library causes a Denial of Service whileparsing a specially crafted payload with 'empty' data type. For example,if the payload is record { * ; empty } and the canister interface expects record { * } then the Rust candid decoder treats empty as an extra field required by the type. The pro...