CVE-2022-23327
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all pending transactions in a victim node's memory pool, causing a denial of service (DoS).
Risk Assessment
The risk is the potential for a DoS attack on an Ethereum node, which can disrupt applications or services relying on that node, leading to downtime and loss of trust.
Recommendation
It is recommended to immediately upgrade Go-Ethereum to a version later than 1.10.12, which includes a fix for this vulnerability.
Other vulnerabilities in Go-Ethereum
See all- CVE-2026-22868High
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.
- CVE-2026-22862High
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.
- CVE-2022-23328High
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
Original NVD description (English source)
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).