Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/microstack-tech/parallax
  4. ›
  5. GHSA-xc79-566c-j4qx

GHSA-xc79-566c-j4qx: Parallax is vulnerable to DoS via malicious p2p message

October 10, 2025 (updated October 23, 2025)

A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.

In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message with a count of 0, using the Parallax protocol.

In descendants := chain.GetHeadersFrom(num+count-1, count-1), the value of count-1 is passed to the function GetHeadersFrom(number, count uint64) as parameter count. Due to integer overflow, UINT64_MAX value is then passed as the count argument to function GetHeadersFrom(number, count uint64). This allows an attacker to bypass maxHeadersServe and request all headers from the latest block back to the genesis block.

References

  • github.com/advisories/GHSA-xc79-566c-j4qx
  • github.com/microstack-tech/parallax
  • github.com/microstack-tech/parallax/commit/f759e9090aaf00a43c616d7cbd133c44bb1ed01e
  • github.com/microstack-tech/parallax/releases/tag/v0.1.4
  • github.com/microstack-tech/parallax/security/advisories/GHSA-xc79-566c-j4qx
  • pkg.go.dev/vuln/GO-2025-4019

Code Behaviors & Features

Detect and mitigate GHSA-xc79-566c-j4qx with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.1.4

Fixed versions

  • 0.1.4

Solution

Upgrade to version 0.1.4 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

go/github.com/microstack-tech/parallax/GHSA-xc79-566c-j4qx.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 04 Nov 2025 12:18:49 +0000.