WS-2024-0016

Monero monerod is vulnerable to denial of service via memory exhaustion in its RPC service. A client that spams requests to an exposed RPC port without reading the responses causes monerod to retain those responses in memory indefinitely until the process crashes. Any node exposing its RPC port i...

WS-2022-0460

Monero daemon monerod does not limit Content-length variable when processing incoming HTTP requests. An attacker can force monerod to allocate arbitrary amount of memory. Version 0.17.3.2 contains sanity check to RPC input data size...

Monero: monerod JSON RPC server remote DoS

Monero daemon monerod does not limit Content-length variable when processing incoming HTTP requests. We can force monerod to allocate arbitrary amount of memory. How to reproduce: 1 compile monero https://github.com/monero-project/monero 2 run it: $ ulimit -Sv 1000000000 $ ./bin/monerod --rpc-log...

Monero: Remote node DOS

A vulnerability was discovered in monerod, the Monero daemon. The vulnerability allowed an attacker to repeatedly request enough objects to fill the outgoing send queue for each peer-to-peer connection, causing the connection threads to sleep for approximately 6 seconds and then terminate the...