Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
あれ俺が去年Gethに報告して修正したバグ、その2年前に同じ報告がCVEでHighつけられてるけどどういうことだ？ https://github.com/ethereum/go-ethereum/pull/32344 https://nvd.nist.gov/vuln/detail/CVE-2023-42319
Post summary
The user highlights a mismatch between the CVE’s high severity rating and a recent fix they submitted, linking to a PR that contains the patch but providing no exploitation details or PoC. The post’s focus is on resolving the vulnerability through a patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ethereum | go_ethereum | - | - | - |