CVE-2024-32972CWE-400

go-ethereum denial of service via malicious p2p message

High · published May 6, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version `1.13.15` and onwards.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00846 · 57.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-05-06T14:26Z
EPSS history
Timeline
  • 06 MAY 14:26Z
    go-ethereum denial of service via malicious p2p message
    cvelistv5