CVE-2023-34458

HighCVSS 7.1

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.07%

60th percentile - higher than 60% of all known CVEs

Summary

A vulnerability in mx-chain-go, the official implementation of the MultiversX blockchain protocol, allowed for the sender account nonce of an inner transaction to be increased if the inner transaction failed. This could lead to a limited DoS attack on a targeted account.

Risk Assessment

The organization may be exposed to DoS attacks that could affect the availability of services related to the account. The increase in nonce could lead to unpredictable behavior in transactions.

Recommendation

It is recommended to update to version 1.4.17 to patch this vulnerability. Additionally, the new flag `RelayedNonceFixEnableEpoch` should be enabled for proper transaction handling.

Other vulnerabilities in mx-chain-go

CVE-2023-33964High
In versions prior to 1.4.16, the metachain in the mx-chain-go implementation incorrectly processed transactions with an invalid username, which could lead to the halting of block notarization from shards.

Original NVD description (English source)

mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS