CVE-2024-4435 is a Medium (CVSS 5.9) memory leak in the ic-stable-structures Rust crate from DFINITY. Deallocating a BTreeMap node holding unbounded types can free only the first memory chunk. The record says the fix ships in version 0.6.4, so upgrade the crate and rebuild your canister.
What's affected
- Product: ic-stable-structures, DFINITY's Rust crate for stable memory on the Internet Computer.
- Affected: BTreeMap nodes that store unbounded types, which are represented as a linked list of memory chunks.
- Fixed version: 0.6.4, per the record. The fix is pull request 212, which changes deallocation so all chunks are freed.
- Severity: Medium, CVSS 5.9, availability impact only and high attack complexity.
- The record says tests were added to prevent regressions.
- Exploitation: KEV is false.
How to check if you're exposed
Check the dependency in your canister project:
cargo tree -i ic-stable-structures
grep -A1 'name = "ic-stable-structures"' Cargo.lock
A version below 0.6.4 is the affected range. Then check whether your canister stores unbounded types in a BTreeMap. Types with a fixed maximum size do not use the chunked layout the record describes.
What to do now
- Run the cargo commands in every canister repository.
- Update ic-stable-structures to 0.6.4 or later in Cargo.toml and refresh Cargo.lock.
- Rebuild and test the canister before upgrading it on the network.
- Review how your canister uses BTreeMap with unbounded keys or values, and whether callers can drive repeated inserts and removals.
- Monitor the canister's stable memory use over time.
Why it matters
The record maps this to CWE-401, a memory leak caused by missing release of a resource. A node is a chain of chunks, and in some cases only the first one is returned. Over many operations the lost chunks add up.
On the Internet Computer, memory is limited and paid for. An adversary who can call your public API and trigger the pattern repeatedly may exhaust it, which is why the record treats it as an availability issue.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
0.6.4, according to the record and its linked pull request.
Does it affect all BTreeMap uses?
The record limits it to nodes storing unbounded types, which use linked chunks.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4435 (published 2024-05-21) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
