Denial of Service in Go-Ethereum

GHSA-pvx3-gm3c-gmpr · CVE-2022-23327

Published Mar 5, 2022 · Modified Nov 8, 2023

Description

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-23327
WEB https://dl.acm.org/doi/pdf/10.1145/3460120.3485369
PACKAGE https://github.com/ethereum/go-ethereum
WEB https://tristartom.github.io/docs/ccs21.pdf

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes