4 results · Feed
-
Unscored —
`nostr-relay-pool` is unmaintained
The `nostr-relay-pool` crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into [`nostr-sdk`](https://crates.io/crates/nostr-sdk) starting with version `0.45.0`. Users should migrate to [`nostr-sdk`](https://c…
-
High 7.5
Processing of unverified relay events
The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be s…
-
High 7.5
Relay authentication challenges can exhaust memory
The SDK forwarded every NIP-42 `AUTH` challenge received from a relay through an unbounded command queue. Challenge handling can wait for an asynchronous signer or user interaction, so receiving challenges was substantially faster than completing the correspo…
-
High 7.5
Verification cache poisoning allows forged Nostr events to bypass signature validation
The `nostr-relay-pool` crate cached the result of event signature verification before the check was actually performed. Because the entry was inserted unconditionally, a first delivery whose signature failed was still recorded in the cache. A subsequent deliv…