Skip to content
OpenAdvisories
High · 7.5 CVE-2023-40591 EUVD-2023-2566GHSA-ppjg-v974-84cmGO-2023-2046

Denial of service via malicious p2p message in go-ethereum

Published Sep 6, 2023 · Updated Sep 26, 2024 · Assigned by GitHub_M

Description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffectedFixed
ethereum go-ethereum < 1.12.1-stable —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/ethereum/go-ethereum < 1.12.1-stable 1.12.1-stable GHSA-ppjg-v974-84cm
Go github.com/ethereum/go-ethereum < 1.12.1 1.12.1 GO-2023-2046

References