GitHub Advisoryadvisory · Go

GHSA-wq32-8rp4-w2mc Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow

HIGH Published 2025-03-27 Modified 2025-03-28 Official page ↗
Aliases
CVE-2025-29072
Ecosystem
Go
Packages
github.com/NethermindEth/juno
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190, CWE-770
Reviewed
2025-03-28

Affected packages

• Go github.com/NethermindEth/juno: < 0.12.5 → fixed in 0.12.5

Description

An integer overflow in Nethermind Juno before v0.12.5 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.

Related

Alias · CVE (1)

  • CVE-2025-29072 An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the… vulnerability

Weakness · CWE (2)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References