{"id":"GHSA-ppjg-v974-84cm","summary":"Go-Ethereum vulnerable to denial of service via malicious p2p message","details":"### Impact\n\nA vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.\n\n### Details\n\nThe p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.\n\n### Patches\n\nThe fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. \n\nFixed by https://github.com/ethereum/go-ethereum/pull/27887\n\n### Workarounds\n\nNo known workarounds. \n\n### Credits\n\nThis bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org). \n\n### References\n\n","aliases":["CVE-2023-40591","GO-2023-2046"],"modified":"2026-09-10T03:49:58.385793589Z","published":"2023-09-06T19:49:46Z","database_specific":{"nvd_published_at":"2023-09-06T19:15:44Z","cwe_ids":["CWE-400"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-09-06T19:49:46Z"},"references":[{"type":"WEB","url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40591"},{"type":"WEB","url":"https://geth.ethereum.org/docs/developers/geth-developer/disclosures"},{"type":"PACKAGE","url":"https://github.com/ethereum/go-ethereum"},{"type":"WEB","url":"https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1"}],"affected":[{"package":{"name":"github.com/ethereum/go-ethereum","ecosystem":"Go","purl":"pkg:golang/github.com/ethereum/go-ethereum"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.1-stable"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-ppjg-v974-84cm/GHSA-ppjg-v974-84cm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}