CVE-2018-12018

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-129

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/16891Issue Tracking, Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11Third Party Advisory
https://peckshield.com/2018/06/27/EPoD/Exploit, Third Party Advisory
https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/16891Issue Tracking, Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11Third Party Advisory
https://peckshield.com/2018/06/27/EPoD/Exploit, Third Party Advisory

Timeline

Published: Jul 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-120197.5The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track CVE-2018-12024.8Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-si CVE-2018-120207.5mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers CVE-2018-120216.5Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay CVE-2018-120227.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally CVE-2018-120237.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally CVE-2018-120257.5The transferFrom function of a smart contract implementation for FuturXE (FXE), an Ethereum ERC20 token, allows attackers to accomplish an u CVE-2018-120269.8During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applicatio CVE-2018-120278.8An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following CVE-2018-120287.8An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious applic CVE-2018-120297.0A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-stan CVE-2018-12036.7In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 -