ckb-vm

Nervos CKB VM CKB VM 소개 CKB VM은 CKB에서 스크립팅 VM으로 사용되는 RISC-V 명령어 집합의 순수 소프트웨어 구현체입니다. 현재 32비트 및 64비트 레지스터 크기를 지원하는 완전한 IMCB 명령어를 구현하고 있습니다. 향후에는 더 나은 암호화 구현을 위해 V 확장도 구현할 수 있습니다. 라이선스 Nervos CKB는 MIT 라이선스 조건에 따라 배포됩니다. 자세한 내용은 COPYING을 참조하거나 https://opensource.org/licenses/MIT를 방문하세요. 개발 프로세스 현재...

ckb-vm v0.24.15

Nervos CKB VM About CKB VM CKB VM is a pure software implementation of the RISC-V instruction set used as scripting VM in CKB. Right now it implements full IMCB instructions for both 32-bit and 64-bit register size support. In the future we might also implement V extensions to enable better crypt...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +65 more potentially affected by CVE-2026-41681 via openssl (>=0.10.40, <=0.10.68)

openssl CARGO version =0.10.40, =0.5.0, =0.2.0, =0.0.1, =0.1.0-alpha.0, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.3, =0.1.10 and more Source cves: CVE-2026-41681 Source advisory: OSV:GHSA-GHM9-CR32-G9QJ...

EUVD-2022-0422

Malicious code in bioql PyPI...

EUVD-2022-0528

Malicious code in bioql PyPI...

EUVD-2022-0568

Malicious code in bioql PyPI...

CVE-2021-45700

An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service Nervos CKB blockchain node crash via a dead call that is used as a DepGroup...

CVE-2021-45698

An issue was discovered in the ckb crate before 0.40.0 for Rust. A getblocktemplate RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction...

CVE-2021-45699

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize

Detailed Report: https://oss-fuzz.com/testcase?key=6638724308074496 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

WS-2023-0032

Nervos CKB before 0.101.4 vulnerable to low-resource flood DDoS attacks through network message...

WS-2022-0364

In ckb in Rust prior to 0.43.3 and 0.100.0, when a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles...

WS-2022-0361

ckb: Transaction headerdeps validation issue network forking...

Nervos CKB Permit load cell data from memory

Impact The faulty nodes will reject transactions which calls loadcelldata syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation. Patches 0.35.2, 0.36.1, 0.37.1, 0.38.2...

GHSA-29C2-65RJ-H343 Nervos CKB Permit load cell data from memory

Impact The faulty nodes will reject transactions which calls loadcelldata syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation. Patches 0.35.2, 0.36.1, 0.37.1, 0.38.2...

Nervos CKB Pool does not remove the conflicting transactions from the statistics

Impact There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions. Patches 0.39.2 Workarounds Restart the CKB node...

GHSA-H4C3-5275-VRMG Nervos CKB Pool does not remove the conflicting transactions from the statistics

Impact There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions. Patches 0.39.2 Workarounds Restart the CKB node...

Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none...

GHSA-Q73F-W3H7-7WCC Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none...

Nervos CKB Snappy decompress length can be very large and causes out of memory error

Impact Adversary can create message which compressed size is less than the package limit but the decompressed length is very large such as 1G. It will cost the node many memories to process the network messages, and on the system with less than 1G memory, the process is killed directly because of...