GHSA-ppjg-v974-84cm
GitHub Security Advisory
Go-Ethereum vulnerable to denial of service via malicious p2p message
Advisory Details
### Impact
A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.
### Details
The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.
### Patches
The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards.
Fixed by https://github.com/ethereum/go-ethereum/pull/27887
### Workarounds
No known workarounds.
### Credits
This bug was reported by Patrick McHardy and reported via [[email protected]](mailto:[email protected]).
### References
Affected Packages
Related CVEs
Key Information
Dataset
Data from GitHub Advisory Database. This information is provided for research and educational purposes.