CVE-2023-6245

The Candid library causes a Denial of Service while parsing a specially
crafted payload with ‘empty’ data type. For example, if the payload is
record { * ; empty } and the canister interface expects record { * }
then the Rust candid decoder treats empty as an extra field required by the
type. The problem with the type empty is that the candid Rust library
wrongly categorizes empty as a recoverable error when skipping the field
and thus causing an infinite decoding loop. Canisters using affected
versions of candid are exposed to denial of service by causing the decoding
to run indefinitely until the canister traps due to reaching maximum
instruction limit per execution round. Repeated exposure to the payload
will result in degraded performance of the canister. Note: Canisters
written in Motoko are unaffected.