CVE-2023-42319

2023-10-1800:00:00

mitre

github.com

geth

go-ethereum

denial of service

memory consumption

daemon hang

remote attacks

crafted query

graphql

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.2%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor’s position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*"
    ],
    "vendor": "ethereum",
    "product": "go_ethereum",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.13.4"
      }
    ],
    "defaultStatus": "unknown"
  }
]