CVE-2022-23327

Vulnerability

A design flaw in Go-Ethereum versions 1.10.12 and older allows an attacker to send a single message containing 5120 future-dated transactions with a high gas price. This causes the victim node to purge all pending transactions from its memory pool, resulting in a denial of service (DoS). The bug is present in the transaction pool handling code and requires no special configuration beyond a running node accepting network messages [1][2].

Exploitation

An attacker must be able to send messages to the victim node over the Ethereum peer-to-peer network. No authentication is required, as the victim node processes transactions from connected peers. The attacker crafts a single message containing 5120 transactions that are valid except for having a future nonce and a high gas price. When the victim node receives this message, it processes all 5120 transactions, which causes its transaction pool to evict all existing pending transactions [2].

Impact

A successful attack empties the victim node's mempool of all pending transactions. This prevents the node from including any pending transactions in new blocks, effectively causing a denial of service for transaction processing. The attacker does not gain any code execution or data access; the impact is limited to the temporary disruption of transaction handling until new transactions are received [2].

Mitigation

The vulnerability is fixed in Go-Ethereum version 1.10.13, released shortly after the disclosure. Users should upgrade to at least this version. No workarounds are documented. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1][2].