GitHub Advisoryadvisory · Go

GHSA-pvx3-gm3c-gmpr Denial of Service in Go-Ethereum

HIGH Published 2022-03-05 Modified 2026-09-02 Official page ↗
Aliases
CVE-2022-23327
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2022-03-09

Affected packages

• Go github.com/ethereum/go-ethereum: <= 1.10.12 (no fix yet)

Description

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).

Related

Alias · CVE (1)

  • CVE-2022-23327 A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References