CVE-2024-32972

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version `1.13.15` and onwards.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-329734.8Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively in CVE-2024-329747.5Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` wit CVE-2024-329757.5Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by i CVE-2024-329767.5Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompressi CVE-2024-329779.4OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerab CVE-2024-329786.6Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions CVE-2024-329796.1Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a Pos CVE-2024-32987.8Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through CVE-2024-329809.1Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically config CVE-2024-329815.4Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit CVE-2024-329828.2Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion CVE-2024-329837.5Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of inco