| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ethereum/go-ethereum | < 1.9.25 | 1.9.25 |
| go ethereum | < 1.9.25 | 1.9.25 |
A DoS vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client.
The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896.
This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit.
It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free