Skip to content

DoS via malicious p2p message

High
holiman published GHSA-4xc9-8hmq-j652 May 6, 2024

Package

gomod go-ethereum (Go)

Affected versions

<1.13.15

Patched versions

1.13.15

Description

Impact

A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.

More in-depth details will be released at a later time.

Patches

The fix has been included in geth version 1.13.15 and onwards.

Workarounds

No workarounds have been made public.

References

No more information is released at this time.

Credit

This issue was disclosed responsibly by DongHan Kim via the Ethereum bug bounty program. Thank you for your cooperation.

Severity

High

CVE ID

CVE-2024-32972

Weaknesses

No CWEs