Posts tagged cve replication.

A go-ethereum eth-protocol peer that sends a GetBlockHeaders request with amount (count) set to 0 triggers an integer underflow — count-1 wraps to UINT64_MAX — bypassing the maxHeadersServe cap and forcing the node to serve headers back to genesis, a publicly disclosed memory-exhaustion DoS (CVE-2024-32972, fixed in geth 1.13.15) that NullRabbit reproduced as a lab detection bundle.

rust-libp2p's gossipsub implementation stores a peer-supplied PRUNE backoff duration and later adds a further duration to it during heartbeat processing using unchecked arithmetic; a single crafted PRUNE with a backoff value near u64::MAX overflows that addition and panics the process.