CVE-2021-42219

Vulnerability

A memory management issue exists in Go-Ethereum v1.10.9 within the /ethash/algorithm.go component. The missing memory allocation handling allows an attacker to exhaust the node's memory resources by sending an excessive number of messages, leading to a denial of service (DoS) condition [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a large volume of messages to an affected Go-Ethereum node. No authentication is required. The excessive messages trigger the memory flaw, gradually consuming available memory until the node becomes unresponsive or crashes [1].

Impact

Successful exploitation results in a denial of service (DoS) due to memory exhaustion. The node may crash or become unresponsive, disrupting network participation and services. No other impact (e.g., code execution or data leakage) has been reported [1].

Mitigation

As of the published description, no fixed version has been explicitly disclosed in the available references. Users of Go-Ethereum v1.10.9 should monitor the project's release notes for a patched version and consider upgrading immediately once available [1].