CVE-2022-29177

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
ethereum	go-ethereum	< 1.10.17

References

https://github.com/ethereum/go-ethereum/pull/24507Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/24507Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5Patch, Third Party Advisory

Timeline

Published: May 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-291788.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior CVE-2022-291798.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to ver CVE-2022-291809.8A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the se CVE-2022-291818.2Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and H CVE-2022-291825.4GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based CVE-2022-291836.1GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pi CVE-2022-291848.8GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions CVE-2022-291854.4totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version CVE-2022-291869.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise d CVE-2022-291877.8Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is v CVE-2022-291886.5Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which externa CVE-2022-291895.3Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network tr