CVE-2023-42319: High severity ethereum blockchain vulnerability
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
Other sources
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query.
NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-42319?
CVE-2023-42319 is a vulnerability in Geth (aka go-ethereum) through version 1.13.4 that allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query.
How can the CVE-2023-42319 vulnerability be exploited?
The CVE-2023-42319 vulnerability can be exploited by sending a crafted GraphQL query to a Geth node that has the --http --graphql flags enabled.
What is the impact of CVE-2023-42319?
The impact of CVE-2023-42319 is a denial of service, which can lead to memory consumption and the hang of the Geth daemon.
How can I protect my system from CVE-2023-42319?
To protect your system from CVE-2023-42319, you should upgrade Geth to a version that is not affected by this vulnerability.
Where can I find more information about CVE-2023-42319?
You can find more information about CVE-2023-42319 on the official Geth documentation, the CVE database, and the MevSec blog.