HIGH7.5

GHSA-pvx3-gm3c-gmpr

Denial of Service in Go-Ethereum

Details

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/ethereum/go-ethereum

Introduced in: 0

No fixed version published yet for github.com/ethereum/go-ethereum (go modules). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-23327[ADVISORY]
https://dl.acm.org/doi/pdf/10.1145/3460120.3485369[WEB]
https://github.com/ethereum/go-ethereum[PACKAGE]
https://nrdax.com/techniques/NRDAX-T0156-mempool-pending-eviction-flood[WEB]
https://tristartom.github.io/docs/ccs21.pdf[WEB]