| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ethereum/go-ethereum | < 1.12.1< 1.12.1-stable | 1.12.11.12.1-stable |
| go ethereum | ≥ 1.10.0, < 1.12.1 | 1.12.1 |
A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.
The p2p handler spawned a new goroutine to respond to ping requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.
The fix is included in geth version 1.12.1-stable, i.e, 1.12.2-unstable and onwards.
Fixed by https://github.com/ethereum/go-ethereum/pull/27887
No known workarounds.
This bug was reported by Patrick McHardy and reported via [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free