CVE-2023-40591

Summary: Go-Ethereum (geth) vulnerable to Denial of Service via unbounded memory consumption when processing specially crafted p2p messages from an attacker node. The root cause is memory exhaustion triggered by handling crafted p2p messages; a vulnerable node can allocate unbounded memory, poten...

CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

CVE-2023-40591

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version "1.12.1-stable", i.e,...

PT-2023-27526 · Unknown · Go-Ethereum

Name of the Vulnerable Software and Affected Versions: go-ethereum geth versions prior to 1.12.1-stable Description: A vulnerable node can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. This occurs because the p2p handler...

Ethereum Go-ethereum Resource Management Error Vulnerability

Ethereum Go-ethereum is a codebase from the Ethereum community that implements the Ethereum protocol in the Go language. A resource management error vulnerability exists in Ethereum Go-ethereum version 1.10.0, which stems from unlimited memory consumption...

CVE-2023-40591: Uncontrolled Resource Consumption

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

SUSE CVE-2018-19184

cmd/evm/runner.go in Go Ethereum aka geth 1.8.17 allows attackers to cause a denial of service SEGV via crafted bytecode...

go-ethereum:fuzz_trie_nodes: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5374237029564416 Project: go-ethereum Fuzzing Engine: libFuzzer Fuzz Target: fuzztrienodes Job Type: libfuzzerasango-ethereum Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

Privilege Escalation

github.com/ethereum/go-ethereum is vulnerable to privilege escalation. The vulnerability exists because the time stamp when mining blocks is not properly validated which allows an attacker to change the time-difference values and replace main-chain blocks...

GHSA-RQMG-HRG4-FM69 Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum (geth)

CVE-2022-37450: Undefined Security Weakness

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

Go Ethereum security vulnerabilities

Go Ethereum is an official Go implementation of the Ether protocol for the Ethereum community. A security vulnerability exists in Go Ethereum version 1.10.21, which stems from allowing an attacker to increase rewards by mining blocks under certain circumstances and using time-differential value...

PT-2022-24009

Name of the Vulnerable Software and Affected Versions Go Ethereum aka geth versions 1.10.21 and earlier Description The issue allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks...

go-ethereum:fuzzTxfetcher: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6701473429323776 Project: go-ethereum Fuzzing Engine: libFuzzer Fuzz Target: fuzzTxfetcher Job Type: libfuzzerasango-ethereum Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address...

GHSA-WJXW-GH3M-7PM5 DoS via malicious p2p message in Go Ethereum

Impact A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Patches The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507 Workarounds Aside from applying t...