CVE-2023-34458

    Dashboard / Vulnerabilities / CVE-2023-34458

    CVE-2023-34458

    Published: 13 Jul 2023Last Modified: 12 Aug 2026

    Summary: mx-chain-go's relayed transactions always increment nonce

    Details: mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.

    References: https://github.com/multiversx/mx-chain-go/blob/babdb144f1316ab6176bf3dbd7d4621120414d43/integrationTests/vm/txsFee/relayedMoveBalance_test.go#LL165C14-L165C14, https://github.com/multiversx/mx-chain-go/releases/tag/v1.4.17, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34458.json, https://github.com/multiversx/mx-chain-go/security/advisories/GHSA-j494-7x2v-vvvp, https://nvd.nist.gov/vuln/detail/CVE-2023-34458, https://github.com/multiversx/mx-chain-go/commit/babdb144f1316ab6176bf3dbd7d4621120414d43

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -babdb144f1316ab6176bf3dbd7d4621120414d43

    Affected versions

    v1.4.16

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-34458 | CVE-DB