Oct. 18, 2023, 6:15 a.m. |

National Vulnerability Database web.nvd.nist.gov

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.

attackers attacks clients cve daemon denial of service endpoint ethereum geth graphql http memory query service traffic vendor

Red Team Penetration Tester and Operator, Junior

@ Booz Allen Hamilton | USA, VA, McLean (1500 Tysons McLean Dr)

Director, Security Operations & Risk Management

@ Live Nation Entertainment | Toronto, ON

IT and Security Specialist APAC (F/M/D)

@ Flowdesk | Singapore, Singapore, Singapore

Senior Security Controls Assessor

@ Capgemini | Washington, DC, District of Columbia, United States; McLean, Virginia, United States

GRC Systems Solution Architect

@ Deloitte | Midrand, South Africa

Cybersecurity Subject Matter Expert (SME)

@ SMS Data Products Group, Inc. | Fort Belvoir, VA, United States