CVE-2022-23327: Go-Ethereum denial of service via mempool transaction flood

CVE-2022-23327 · Severity: high · CVSS 7.5 · Published 2022-03-05

Go-Ethereum is the most widely deployed Ethereum node client, used to validate transactions and maintain the blockchain network. A design flaw allows an attacker to send a specially crafted message containing 5,120 high-value future transactions that floods and clears the pending transaction memory pool on a victim node, causing it to reject legitimate transactions and disrupting network participation for that node.

Technologies: github.com/ethereum/go-ethereum (Go). Vendors: Go.

Quick answers

Is CVE-2022-23327 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-23327 being exploited in the wild.
How severe is CVE-2022-23327?
High severity, with a CVSS score of 7.5, published 5 March 2022.
Which products and versions are affected?
Ethereum Go-Ethereum <= 1.10.12; github.com/ethereum/go-ethereum (Go) <= 1.10.12, SEMVER:introduced=0,last_affected=1.10.12.
Is there a fix for CVE-2022-23327?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-23327 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-23327?
Check whether you run Ethereum Go-Ethereum or github.com/ethereum/go-ethereum (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the transaction mempool management of Go-Ethereum versions 1.10.12 and earlier. An attacker-controlled Ethereum node can craft a network message containing up to 5,120 future-dated transactions with artificially high gas prices. When a victim node receives this message, the high-gas-price transactions are prioritized and added to the memory pool, displacing all existing pending transactions and effectively clearing the mempool. The attack requires only network connectivity to the victim node (no authentication or user interaction needed). The impact is denial of service—the victim node becomes unable to process legitimate pending transactions. As of the advisory publication date, no patched version was identified in the advisory, though the vulnerability likely prompted corrective measures in later releases.

Affected products

  • Ethereum Go-Ethereum <= 1.10.12

Identifiers

  • CVE-2022-23327
  • GHSA-pvx3-gm3c-gmpr

Timeline

  • 2022-03-04: disclosed: Published to National Vulnerability Database
  • 2022-03-05: advisory: Published to GitHub Advisory Database
  • 2022-03-09: other: GitHub security review completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.