Skip to content
OpenAdvisories
High · 7.5 CVE-2022-23328 EUVD-2022-1547GHSA-vmf7-hmh6-vv57

Denial of Service in Go-Ethereum

Published Mar 4, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Description

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/ethereum/go-ethereum <= 1.10.16 — GHSA-vmf7-hmh6-vv57

References