GHSA-xc79-566c-j4qx: Parallax is vulnerable to DoS via malicious p2p message
(updated )
A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.
In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message with a count of 0, using the Parallax protocol.
In descendants := chain.GetHeadersFrom(num+count-1, count-1), the value of count-1 is passed to the function GetHeadersFrom(number, count uint64) as parameter count. Due to integer overflow, UINT64_MAX value is then passed as the count argument to function GetHeadersFrom(number, count uint64). This allows an attacker to bypass maxHeadersServe and request all headers from the latest block back to the genesis block.
References
- github.com/advisories/GHSA-xc79-566c-j4qx
- github.com/microstack-tech/parallax
- github.com/microstack-tech/parallax/commit/f759e9090aaf00a43c616d7cbd133c44bb1ed01e
- github.com/microstack-tech/parallax/releases/tag/v0.1.4
- github.com/microstack-tech/parallax/security/advisories/GHSA-xc79-566c-j4qx
- pkg.go.dev/vuln/GO-2025-4019
Code Behaviors & Features
Detect and mitigate GHSA-xc79-566c-j4qx with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →