Vulnerabilities in pkg:golang/github.com/ethereum/go-ethereum

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pvx3-gm3c-gmpr",
  "modified" : "2026-09-02T22:05:49Z",
  "published" : "2022-03-05T00:00:46Z",
  "aliases" : [ "CVE-2022-23327" ],
  "summary" : "Denial of Service in Go-Ethereum",
  "details" : "A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/ethereum/go-ethereum"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.10.12"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-23327"
  }, {
    "type" : "WEB",
    "url" : "https://dl.acm.org/doi/pdf/10.1145/3460120.3485369"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ethereum/go-ethereum"
  }, {
    "type" : "WEB",
    "url" : "https://nrdax.com/techniques/NRDAX-T0156-mempool-pending-eviction-flood"
  }, {
    "type" : "WEB",
    "url" : "https://tristartom.github.io/docs/ccs21.pdf"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-03-09T19:20:04Z",
    "nvd_published_at" : "2022-03-04T12:15:00Z"
  }
}