GHSA-ppjg-v974-84cm

    Dashboard / Vulnerabilities / GHSA-ppjg-v974-84cm

    GHSA-ppjg-v974-84cm

    Published: 6 Sept 2023Last Modified: 10 Sept 2026

    Summary: Go-Ethereum vulnerable to denial of service via malicious p2p message

    Details: ### Impact A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. ### Details The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM. ### Patches The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Fixed by https://github.com/ethereum/go-ethereum/pull/27887 ### Workarounds No known workarounds. ### Credits This bug was reported by Patrick McHardy and reported via [[email protected]](mailto:[email protected]). ### References

    References: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm, https://nvd.nist.gov/vuln/detail/CVE-2023-40591, https://geth.ethereum.org/docs/developers/geth-developer/disclosures, https://github.com/ethereum/go-ethereum, https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1

    Affected packages

    Package

    Name: github.com/ethereum/go-ethereum

    Purl: pkg:golang/github.com/ethereum/go-ethereum

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.12.1-stable

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-ppjg-v974-84cm | CVE-DB