NRDAX - the NullRabbit Decentralised Attack indeX

NRDAX-T0323 - Unbounded Filter Subscription Storage Exhaustion

2026-08-20T00:00:00Z

Besu FilterRepository stores all installed log/block/pending-tx filters in an unbounded ConcurrentHashMap, so eth_newFilter can be called without limit by an unauthenticated caller and each call retains server-side state. Fixed in 26.7.1, which caps active filters and returns -32005 past the cap (boundary MEASURED 2026-08-20 against 26.6.0/26.7.0/26.7.1/26.8.0, not taken from the advisory text).

NRDAX-T0417 - Malformed RLP Field-Length Panic

2026-07-21T00:00:00Z

conflux-rust#3497 (conflux-rust light protocol): a single unauthenticated StorageRoots (clp msg_id 0x1b) whose roots[0].root.delta = RLP list [3] makes MptValue::decode hit `n => panic!` during RLP decode, before request-matching. Victim = a LIGHT node (its clp client handler decodes StorageRoots). Verified live vs vulnerable v3.0.3 (f44f1cb, node_type=light): after the clp handshake (StatusPingV2/StatusPongV2), one 0x1b panics thread 'Socket IO Worker' at primitives/src/storage.rs:144; ~2 msgs freeze P2P. Fixed by returning a DecoderError. https://github.com/Conflux-Chain/conflux-rust/pull/3497

NRDAX-T0414 - Invalid Sighash Type Validation Gap

2026-07-21T00:00:00Z

The node's transaction-verification layer fails to enforce the rule that a transparent-input signature's trailing hash-type byte must be one of the known canonical values (ALL/NONE/SINGLE and their ANYONECANPAY variants); this validation, previously enforced in an older verifier, was dropped during a parsing/verification refactor. An attacker submits a validly-signed transaction whose hash-type byte is an unrecognized value, which the defective node silently masks to a canonical type when computing the sighash digest instead of rejecting it outright. This causes the vulnerable node to accept and relay/mine a transaction that reference implementations reject, producing a deterministic block/mempool-validity consensus split between patched and unpatched nodes.

NRDAX-T0096 - GraphQL Nested Query Depth CPU Exhaustion

2026-07-21T00:00:00Z

go-ethereum#32344 (geth graphql): a single unauthenticated HTTP POST to /graphql carrying a deeply-nested query `{block{ommers{ommers{...}}}}` is parsed with unbounded nesting depth by graph-gophers/graphql-go; a sufficiently deep query (~1e6 levels) drives recursive-descent parsing past Go's 1 GiB goroutine-stack limit -> `fatal error: stack overflow` -> the geth process crashes (remote DoS). Verified live vs a pre-fix geth (commit dffa1f51): depth 1e6 kills the node. Fixed by graphql.MaxDepth(20). https://github.com/ethereum/go-ethereum/pull/32344

NRDAX-T0411 - SIGHASH_SINGLE Missing-Output Validation Gap

2026-07-20T00:00:00Z

The node's transaction sighash routine fails to reject SIGHASH_SINGLE inputs whose index is >= the number of outputs; instead of throwing (the spec-mandated behavior), it silently substitutes an empty output set when computing the signature digest. An attacker crafts a transparent transaction with more inputs than outputs and signs the offending input with SIGHASH_SINGLE at an out-of-range index against this empty-set digest, producing a signature the defective node validates and accepts into its mempool/block template while spec-compliant nodes reject it. This divergence yields a direct block-validity consensus split between vulnerable and correct implementations.

NRDAX-T0409 - Blocked Address Validation Bypass

2026-07-19T00:00:00Z

ASA-2024-003 / GHSA-4j93-fm92-rp4m (cosmos-sdk cosmos-sdk <= v0.50.3 / <= v0.47.8): x/auth/vesting MsgCreateVestingAccount / MsgCreatePermanentLockedAccount did not reject a blocked `to_address` (a module account on the bank blocklist), so one permissionless signed tx could create a vesting account at an uninitialised blocked module address; a later GetModuleAccount on it panics -> chain halt (CWE-20). Confirmed live: the signed tx reaches DeliverTx on patched gaiad v21 and is rejected with ' is not allowed to receive funds: unauthorized' (the fix's guard); on a vulnerable node it halts the chain. Fixed v0.50.4 / v0.47.9. https://github.com/advisories/GHSA-4j93-fm92-rp4m

NRDAX-T0408 - Unbounded Address List Validation CPU Exhaustion

2026-07-17T00:00:00Z

wasmd message types (MsgStoreCode, MsgStoreAndInstantiateContract, MsgUpdateInstantiateConfig, MsgAddCodeUploadParamsAddresses, etc.) carry an unbounded AccessConfig.Addresses/msg.Addresses list that ValidateBasic() de-duplicates via a map, and this validation runs during ABCI CheckTx before antehandler signature verification. An attacker submits a single unsigned tx via broadcast_tx_sync packing tens of thousands of distinct addresses (bounded only by tx-size gas cost and CometBFT max_bytes), causing large memory allocation and map-operation slowdown in the mempool of every node that receives it. The fix class is bounding/validating list length (or moving the check post-auth) in ValidateBasic before the map de-dup step.

NRDAX-T0407 - Signature Count Integer Overflow Panic

2026-07-17T00:00:00Z

Tx::verify_signatures counts/indexes the public keys in a Section::Authorization using a u8-width counter; a single unauthenticated transaction whose Authorization section carries 256+ Ed25519 public keys (with matching valid signatures) overflows that u8 during mempool CheckTx. The overflow triggers a panic, crashing the validating node from one crafted broadcast_tx_sync submission. Fix-class is bounding/validating the authorization key-count (or widening the counter) before/during signature verification, i.e. an integer-overflow-in-untrusted-length-field defect (CWE-190) in mempool tx validation.

NRDAX-T0403 - DHT First-Record Verification Bypass

2026-07-17T00:00:00Z

handle_dht_get only creates the DhtResults accumulator when the FIRST returned Kademlia record verifies successfully; it never falls back to a later valid record if that first responder's record fails verification. A malicious peer wins the race by answering the get first with a well-formed but unverifiable record (e.g. correct-length but all-zero signature), causing the accumulator to never be initialized. Every subsequent honest, valid record is then compared against the missing/poisoned state and discarded as inconsistent, denying the querying node the real value and blocking peer/validator discovery and routing (improper handling of an unusual/exceptional first-response condition, CWE-754).

NRDAX-T0401 - Boundary-Check Off-By-One Index OOB Panic

2026-07-17T00:00:00Z

The node's proposal-ingest path bounds-checks an attacker-supplied `signer` slot index against the validator-set size using a strict `>` comparison instead of `>=`, so the boundary value `signer == num_validators` passes the check. That value is then used to index the validator array via `get_validator_by_slot_band`, causing an out-of-bounds access, and this happens before any signature verification, so an unauthenticated peer can gossip a single crafted, unsigned proposal to crash every receiving validator. Fix-class: correct the off-by-one bound check (or otherwise validate/clamp the index) prior to array indexing, closing the pre-auth OOB panic (CWE-125/193).

NRDAX-T0381 - ZMQ Message Error-Handling Crash

2026-07-17T00:00:00Z

monero PR #9052: with ZMQ-PUB enabled the ZMQ-RPC server uses zmq_poll; an INVALID non-ZMQ message (e.g. a browser HTTP request to the ZMQ-RPC TCP port) bypasses the poll filter, reaches zmq_read which returns EAGAIN, and the unhandled spurious wakeup PERMANENTLY crashes ZMQ-RPC until restart (remote availability DoS). Fixed by handling EAGAIN. Modelled as the HTTP-to-ZMQ-port wire signature. https://github.com/monero-project/monero/pull/9052

NRDAX-T0009 - Bit-Length Validation Panic

2026-07-17T00:00:00Z

CVE-2026-40092 / GHSA-27w2-87xv-37c6 (nimiq/core-rs-albatross, nimiq/core-rs-albatross before v1.4.0): validator records are published into the libp2p Kademlia DHT (/nimiq/kad/0.0.1) as TaggedSigned (tag 0x03). With set_record_filtering(FilterBoth) every inbound PUT_VALUE reaches Verifier::verify_validator_record, which calls validator_record.verify() -> TaggedPublicKey::verify for Ed25519, previously `Ed25519Signature::from_bytes(sig).unwrap()`. ed25519_zebra rejects any non-64-byte slice, so a record whose TaggedSignature byte-vector is not 64 bytes panics via unwrap() → remote unauthenticated crash DoS. Fixed in v1.4.0 (PR #3708, commit 807ee8e) (return false instead of unwrap). https://github.com/advisories/GHSA-27w2-87xv-37c6

NRDAX-T0399 - Uninitialized Nil Map Access Panic

2026-07-16T00:00:00Z

The AutoNAT v2 server never initialises its per-peer rate-limiter map before use; any well-formed inbound DialRequest on the /libp2p/autonat/2/dial-request stream reaches serveDialRequest -> rateLimiter.CompleteRequest, which performs a write ('assignment to entry in nil map') on that nil map. The fix-class is server-side state initialisation (allocate/guard the map before first write) rather than any input-validation or protocol change, so the defect is a missing-initialisation bug triggered by any valid protocol handshake, causing a remote unauthenticated panic/crash (availability DoS).

NRDAX-T0400 - Unsigned Integer Underflow Accounting Panic

2026-07-15T00:00:00Z

The server's packet-coalescing space-accounting logic performs an unsigned subtraction of remaining datagram space when building its own coalesced Initial response, without checking that the incoming fragmented handshake (split across two CRYPTO frames in two coalesced Initial packets) hasn't already consumed more space than accounted for. An attacker sends a single UDP datagram with two coalesced QUIC Initial packets whose CRYPTO frames reconstruct an oversized (~1222B) ClientHello, triggering an 'attempt to subtract with overflow' at the coalescing arithmetic and crashing the server process pre-handshake. The fix-class is bounds-checked/saturating space accounting in the response-coalescing path, making this the same technique as any other unsigned-underflow-panic in QUIC packet-space bookkeeping triggered by oversized/fragmented handshake input.

NRDAX-T0398 - Unauthenticated Crypto Signing CPU Exhaustion

2026-07-15T00:00:00Z

The bridge signing server exposes its request-handling routes over plain HTTP with no authentication, no per-IP rate limit, and no concurrency/timeout cap - the only middleware layer checks body size, not request rate. An attacker sends cheap unauthenticated GETs to the signing endpoint, each of which the handler expands into backend RPC round-trips (fetch+verify) before signing, so request volume translates directly into backend work with no admission control to shed excess load. This lets a modest unauthenticated flood exhaust the signer's handling capacity, denying enough validators from completing signature assembly to halt the quorum (availability/censorship, not forgery).

NRDAX-T0396 - HTTP/2 Multiplexing Rate-Limit Bypass

2026-07-15T00:00:00Z

The edge's rate limiter counts HTTP/2 cleartext (h2c) connections at layer 4 (per-IP connection count via limit_conn), while the backend (geth :8545) transparently terminates h2c and honors all multiplexed streams within it as independent requests. An attacker who prior-knowledge-upgrades a single TCP connection to h2c opens many concurrent streams (measured 20/20) inside that one connection, each carrying a full RPC call (e.g. eth_getLogs), so the edge sees '1 connection' while the backend processes N requests, yielding request/data-volume amplification (~43.9MB) with the per-IP connection cap never triggering. The defect class is a mismatch between the connection-granularity enforcement point and the stream-granularity request semantics of the multiplexed protocol; the fix-class is enforcing rate/connection limits at the stream (request) level for any multiplexed transport, or disabling/gating h2c cleartext upgrade at the edge so multiplexing cannot cross the limiter boundary.

NRDAX-T0394 - Connection ID Retirement Infinite Loop

2026-07-15T00:00:00Z

The node's connection-ID retirement handler does not terminate/converge when RETIRE_CONNECTION_ID and NEW_CONNECTION_ID sequence numbers are exchanged across multiple migrated paths in a circular pattern (retiring the CID in use on path A from path B and vice versa), violating the RFC 9000 §19.16 invariant that a packet must not retire the CID it was sent on. An attacker who completes the handshake and drives path migration across ≥2 paths while crafting this circular retirement sequence triggers an unbounded loop in the retirement logic (CWE-835), pinning the victim at 100% CPU - a post-handshake remote compute-exhaustion DoS. Fix-class is bounding/validating cross-path CID retirement transitions so the state machine always reaches a valid exit, distinct from fixes that bound the retired-CID store size for single-path floods.

NRDAX-T0392 - Invalid UTF-8 Decode Panic

2026-07-15T00:00:00Z

The node's qlog logging path assumes the CONNECTION_CLOSE/APPLICATION_CLOSE reason-phrase field is valid UTF-8 and decodes it directly into a Rust `str` for logging, even though RFC 9000 §19.19 defines the reason phrase as opaque bytes with no UTF-8 requirement. A remote peer sends a single CLOSE frame (0x1c/0x1d) whose reason-phrase bytes are deliberately invalid UTF-8 (e.g. stray continuation bytes), triggering a decode/conversion panic in the qlog writer and crashing the victim process - a one-packet availability DoS. The fix-class is defensive/lossy decoding (or byte-safe handling) of all peer-supplied opaque protocol fields before they are passed to logging, serialization, or string-typed APIs.

NRDAX-T0338 - Unhandled Enum Variant Panic

2026-07-15T00:00:00Z

CVE-2023-42805 (RUSTSEC-2023-0063): quinn-proto < 0.9.5/0.10.5 panics on a QUIC frame with an UNKNOWN frame type (RFC 9000 §12.4 requires FRAME_ENCODING_ERROR, not a crash). A single packet carrying one undefined-type frame crashes the endpoint (availability DoS). Fixed by principled invalid-frame error handling (quinn PR #1667). Modelled as the unknown-frame-type wire signature. https://rustsec.org/advisories/RUSTSEC-2023-0063.html

NRDAX-T0389 - Precompile Gas Underpricing CPU Burn

2026-07-14T00:00:00Z

The BLAKE2F precompile (0x09) exposes an attacker-controlled 'rounds' field that is charged at a flat 1-gas-per-round rate but executes synchronously on the node's RPC-serving thread; because gas cost scales linearly while wall-clock compute per round is effectively free to request, a small eth_call payload (~585 bytes) can force tens of millions of compression rounds. This yields a large asymmetry between request size/cost and CPU time consumed (~405ms vs ~1ms baseline), letting a single cheap call monopolize a worker thread and degrade node responsiveness. The fix-class is bounding/metering precompile-invoked loop primitives (rounds/iteration caps, tighter gas-to-wall-time calibration, or synchronous-call time budgets) at the eth_call/precompile-dispatch layer.

NRDAX-T0388 - Unbounded Header-List-Size Default OOM

2026-07-13T00:00:00Z

The node-side defect is an insecure default: the HTTP/3 codec's maxHeaderListSize defaults to the near-unbounded RFC 9114 ceiling ((1<<62)-1) whenever a peer omits SETTINGS_MAX_FIELD_SECTION_SIZE, instead of inheriting the safe bounded default already enforced for HTTP/1.1 and HTTP/2. An attacker simply never sends that setting, then transmits a HEADERS/QPACK block containing an enormous COUNT of distinct literal header fields; the codec keeps decoding and buffering each field with no size ceiling. The fix-class is enforcing a safe bounded default (and/or hard cap independent of peer-advertised settings) for field-section size in the HTTP/3 codec, which measurably manifests as unbounded heap growth culminating in OutOfMemoryError/process death.

NRDAX-T0387 - QPACK Blocked-Decode Flow-Control Leak

2026-07-13T00:00:00Z

The QPACK decoder returns QUIC stream- and connection-level flow-control credit for HEADERS bytes belonging to field sections that reference dynamic-table entries not yet inserted (Required Insert Count > inserted count), even though those bytes remain resident in the decoder's blocked-section heap buffer. An attacker sends such blocked field sections and never supplies the corresponding encoder-stream inserts, so the sections never decode or free, while continuing to send more HEADERS traffic using the wrongly-returned flow-control credit. This decouples flow-control accounting from actual buffer occupancy, letting the attacker drive unbounded heap growth in the decoder and exhaust memory/DoS the HTTP/3 stack.

NRDAX-T0386 - Priority-Field Parse-Exception Leak

2026-07-13T00:00:00Z

The HTTP/2 priority parser (RFC 9218 urgency field) throws an unhandled IllegalArgumentException when given an out-of-range value (e.g. u=99), and the request-handling code path lacks a catch/cleanup for this failure, leaving the half-processed request's state permanently retained. An attacker floods the server with malformed PRIORITY_UPDATE frames or priority headers, each triggering the same uncaught-exception path, causing unbounded cumulative memory retention across requests. Effect: gradual heap growth culminating in OutOfMemoryError / DoS. The fix-class is 'catch parser exceptions and ensure per-request cleanup/dispatch on all error paths', distinguishing it from stream-count or flow-control exhaustion techniques.

NRDAX-T0384 - HTTP/2 Continuation Frame Flood

2026-07-13T00:00:00Z

The HTTP/2 decoder's header-list-size guard is size-based (maxHeaderListSize - frameSize < currentSize) and never trips when each CONTINUATION frame carries zero bytes, so no count limit exists on CONTINUATION frames following an unterminated HEADERS block (END_HEADERS=0). An attacker opens a header block and streams an unbounded sequence of zero-length CONTINUATION frames on one connection, each costing only a 9-byte frame header to send. The decoder keeps parsing every frame, monopolizing a CPU thread and producing a compute-exhaustion DoS at negligible attacker bandwidth.

NRDAX-T0383 - HPACK Decoded-Size Accounting Bypass

2026-07-13T00:00:00Z

Envoy's HTTP/2 HPACK decoder bounds header-block size on ENCODED bytes only, and cookie header bytes bypass the max_request_headers_kb decoded-size accounting entirely. An attacker plants one large cookie value once in the HPACK dynamic table via a literal-with-incremental-indexing field, then re-references that single entry many times per request using 1-byte indexed-header-field octets, so the wire stays tiny while Envoy materializes the full cookie value on every reference. The fix-class is bounding/accounting the DECODED header size (including cookie bytes) rather than just the encoded HPACK block, closing the asymmetric-allocation gap; without it, a few connections/streams balloon decoded-header memory past the process limit and get OOM-killed within seconds.

NRDAX-T0382 - Error-Response Connection-State Leak

2026-07-13T00:00:00Z

dnsdist's DoQ/DoH3 receiver allocates per-error bookkeeping state whenever it emits a self-generated FORMERR/REFUSED/SERVFAIL/NOTIMP response, and attaches that state to the QUIC connection object rather than the completed stream/query, freeing it only on full connection teardown. An attacker opens a single DoQ/DoH3 connection and streams a large run of complete, well-formed queries engineered to each trigger a local error response, causing the per-error allocations to accumulate unboundedly for as long as the connection (or its parallel siblings) stays open. The fix-class is scoping/freeing per-error bookkeeping to the query/stream lifetime instead of the connection lifetime, bounding memory growth regardless of connection duration.

NRDAX-T0349 - Unseeded Hash Collision DoS

2026-07-11T00:00:00Z

QUIC SCID hash-collision DoS (CVE-2025-47200): a flood of QUIC v1 Initial packets whose 8-byte Source Connection IDs are crafted to COLLIDE in the server's connection-ID hash table. The server keys active connections on the peer SCID; a weak non-seeded hash (NCC names FNV, xxHash, and `hash = hash*31 + char`) lets the attacker hold a constant 5-byte SCID prefix (5c1dc011de) and vary a 3-byte counter suffix, keeping only suffixes whose full-SCID hash lands in one target bucket - so every DISTINCT SCID collides. Worst-case O(n) bucket walks (amortised O(n^2)) burn server CPU: NCC measured ~300x slowdown from 10k parallel colliding connections. Only SipHash (keyed) mitigates. PUBLIC-CVE replication of the NCC Group / Fox-IT advisory; new corpus wire family = algorithmic-complexity / hash-DoS.

NRDAX-T0280 - Spoofed Endpoint-Proof Bypass Amplification

2026-07-11T00:00:00Z

discv4 FINDNODE->NEIGHBORS reflection/amplification (NethermindEth/nethermind#12211): discv4 is Ethereum's connectionless-UDP node-discovery protocol. A ~170 B FINDNODE (packet-type 0x03) makes the node answer with a NEIGHBORS packet (type 0x04) of up to 16 node records (~8-13x larger). Pre-fix the node honoured FINDNODE without a PING/PONG endpoint proof bound to the exact UDP IP:port, so an attacker SPOOFING the victim's source IP reflects+amplifies the large NEIGHBORS replies onto the victim (DRDoS), and a FINDNODE burst starves the discovery response budget. #12211 requires endpoint-proof bonding (proof from endpoint A no longer authorizes requests to endpoint B) + splits the discovery rate-limit budget 50/50 between outbound requests and protocol responses. Wire framing is faithful (hash[32]||sig[65]||type||rlp; hash=keccak256(sig||type|| data)); a VALID secp256k1 signature is NOT required for the capture - the wire SHAPE + flood is the signature - so the 65-byte sig is synthetic. PUBLIC-FIX REPLICATION - loopback UDP mock plays the node (replies NEIGHBORS); no real Nethermind/geth discovery service stood up.

NRDAX-T0225 - QUIC Control Frame Flood

2026-07-11T00:00:00Z

s2n-quic stream-limit exhaustion (GHSA-475v-pq2g-fp9g): pre-patch `RemoteInitiated::on_close_stream` directly bumped `max_streams_sync` with NO rate limiting, so every close of a remote-initiated stream immediately re-grants stream credit (and makes s2n-quic emit a MAX_STREAMS frame). A peer that rapidly opens-and-closes remote-initiated streams (STREAM open+FIN then RESET_STREAM) while signalling STREAMS_BLOCKED to pull the limit up drives uncontrolled stream-controller churn / limit-sync traffic - 'unnecessary resource utilization when peers open streams beyond advertised limits' (CWE-400). No workaround; fixed in s2n-quic v1.31.0 by adding an RTT-based TokenBucket in RemoteInitiated to throttle the limit increase. Severity Low. PUBLIC-CVE REPLICATION - wire signature only (loopback UDP mock, no s2n-quic server stood up).

NRDAX-T0203 - Ping Flood Pending Frame OOM

2026-07-11T00:00:00Z

CVE-2024-32984 (GHSA-3999-5ffv-wp2r): rust-yamux (0.13.0 .. <0.13.2) buffers frames-to-send in an unbounded `pending_frames` VecDeque. A remote peer floods Ping frames (each enqueues a Pong reply) and/or opens streams while stalling its own TCP receive window (never sending WindowUpdate), so the victim's outbound frame queue cannot drain and grows without bound → remote memory exhaustion (fixed in 0.13.2, which bounds the queue).

NRDAX-T0059 - Duplicate Transport Parameter Memory Leak

2026-07-11T00:00:00Z

msquic duplicate-transport-parameters VersionInfo leak (CVE-2024-26190): flood of QUIC v1 Initial packets (distinct SCID / new connection each), every Initial carrying a CRYPTO frame (type 0x06) whose body is a TLS ClientHello that repeats the quic_transport_parameters extension (0x0039) 32 times, each extension an encoded transport-parameters blob embedding a version_information TP (id 0x11). Pre-fix msquic re-decoded EACH duplicate into the same struct, allocating VersionInfo (QUIC_POOL_VERSION_INFO) per decode and zeroing without freeing -> one leaked heap buffer per duplicate; total leaked ~= connections x 32. The leak is driven during ClientHello extension parsing (pre-handshake-completion), so a loopback mock that cannot finish a real TLS 1.3 handshake still carries the load-bearing artefacts (duplicated 0x0039 extension + embedded 0x11 TP). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected msquic < 2.1.12 (2.1.x), < 2.2.7 (2.2.x), < 2.3.5; fixed 2.1.12, 2.2.7, 2.3.5; CWE-401 (Missing Release of Memory) / CWE-400 (Uncontrolled Resource Consumption); CVSS 3.1 7.5 (High); fix commit d364feeda0dd8b729eca6fef149c1ef98630f0cb. https://github.com/microsoft/msquic/security/advisories/GHSA-2x7m-gf85-3745

NRDAX-T0023 - Coalesced Packet Buffer Leak

2026-07-11T00:00:00Z

QUIC-LEAK / CVE-2025-54939: LSQUIC pre-handshake `packet_in` memory leak from coalesced Initial packets (CVSS 7.5 AV:N/AC:L/PR:N/UI:N/A:H, CWE-401+CWE-770; affected LSQUIC < 4.3.1, fixed 4.3.1 / OpenLiteSpeed 1.8.4 / LiteSpeed Web Server 6.3.4). An unauthenticated remote attacker floods UDP datagrams that each coalesce several QUIC v1 Initial packets - the first with a valid DCID, the rest with distinct invalid DCIDs; lsquic frees only the first coalesced packet_in per datagram and leaks (~96 B each) the rest, before any handshake, bypassing every post-handshake limit -> memory grows at ~70% of bandwidth -> OOM. PUBLIC-CVE REPLICATION captured here as the attack wire signature only (loopback UDP mock; no real lsquic endpoint stood up); the mock_leaked_* counters are a wire-side proxy for the pinned server memory.

NRDAX-T0351 - Unvalidated DHT Record Storage Exhaustion

2026-07-10T00:00:00Z

CVE-2026-45783 / GHSA-32mq-hpph-xfvr: the libp2p Kademlia DHT (@libp2p/kad-dht (npm, js-libp2p), affected < 16.2.6) accepts and persists PUT_VALUE records with no effective validation, count, or byte budget. Two combined defects: (1) `verifyRecord` silently returns early for keys with fewer than 3 slash-delimited parts, so a crafted key bypasses all content validation and the record is written to the datastore anyway; (2) the RPC message loop resets its inactivity timeout after each message and imposes NO per-stream message-count limit and NO per-peer byte budget. Combined: an unauthenticated peer opens one /ipfs/kad/1.0.0 stream and floods distinct crafted PUT_VALUE records → the victim's datastore grows without bound until the host disk is exhausted and the DHT server node becomes unavailable. Server-mode DHT nodes are the default for publicly-routable addresses (IPFS/bootstrap nodes). No auth required. Fixed in 16.2.6 (rejects unrecognized keys instead of silently accepting them).

NRDAX-T0327 - Unbounded Registration Storage Exhaustion

2026-07-10T00:00:00Z

CVE-2026-35457 (GHSA-v5hw-cv9c-rpg7): libp2p-rendezvous server stores DISCOVER pagination cookies in an unbounded in-memory map (Registrations::cookies) with no size cap / eviction / expiry - a flood of unauthenticated /rendezvous/1.0.0 DISCOVER requests forces one fresh Cookie + HashSet entry per request → linear memory growth → remote memory exhaustion (fixed in 0.17.1).

NRDAX-T0321 - Unbounded Connection ID Storage

2026-07-10T00:00:00Z

quic-go connection-ID memory exhaustion (CVE-2024-22189, GHSA-c33x-xqrf-c478): on an established QUIC connection the attacker floods NEW_CONNECTION_ID frames (type 0x18) with an escalating 'Retire Prior To' field. Each escalation forces the peer (RFC 9000 §19.15) to retire the connection IDs below it and to queue a RETIRE_CONNECTION_ID frame per retirement. The attacker prevents the peer from ever draining that queue by collapsing its congestion window (selective ACKing) and inflating its RTT estimate, so the RETIRE_CONNECTION_ID frames accumulate unbounded → peer runs out of memory (CWE-770, no per-connection cap). No workaround; fixed in quic-go v0.42.0. PUBLIC-CVE REPLICATION - wire signature only (loopback UDP mock, no quic-go server stood up).

NRDAX-T0196 - Path Migration Challenge Queue Exhaustion

2026-07-10T00:00:00Z

quiche QUIC PATH_CHALLENGE unbounded-queue flood (CVE-2023-6193): flood of QUIC 1-RTT short-header packets on one DCID arriving from CHANGING source paths (rotating loopback 4-tuples = QUIC connection migration), each carrying a PATH_CHALLENGE frame (type 0x1a) with fresh 8-byte challenge data. The recipient must echo each as a PATH_RESPONSE (type 0x1b) but, cwnd-restricted, drains slower than challenges arrive, so quiche's pending path-validation queue grows without bound. Real CVE is post-handshake 1-RTT frames; a loopback mock cannot complete a real TLS 1.3 handshake, so the queue-growth wire signature is modelled on the QUIC short-header PATH_CHALLENGE surface (frame type 0x1a + changing source paths on a fixed DCID + ever-fresh challenge data are the load-bearing artefacts). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected quiche 0.15.0 through 0.19.0; fixed 0.19.1; CWE-400; CVSS 3.1 5.3 (Moderate). https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm

NRDAX-T0195 - Path Challenge Response Memory Exhaustion

2026-07-10T00:00:00Z

quic-go QUIC path-validation memory exhaustion (CVE-2023-49295): flood of QUIC v1 short-header (1-RTT) packets each carrying PATH_CHALLENGE frame(s) (type 0x1a + 8B challenge data). Each PATH_CHALLENGE obliges the receiver to enqueue a PATH_RESPONSE (type 0x1b); the attacker keeps that queue from draining by collapsing the congestion window (selective ACK) and skewing the RTT estimate, so the queue of un-sendable responses grows without bound -> memory exhaustion. The 'distributed' posture additionally sources the flood from many CHANGING (spoofed) loopback addresses - each a new path that itself triggers path validation (the connection-migration angle of the same CVE). A loopback mock cannot complete a real TLS 1.3 handshake or negotiate real congestion state, so the load-bearing wire artefacts modelled are the PATH_CHALLENGE frame type, the flood density, and the changing-source-address path fan (not real QUIC keys / cwnd). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected quic-go v0.40.0, <= v0.39.3, <= v0.38.1, <= v0.37.6; fixed v0.40.1, v0.39.4, v0.38.2, v0.37.7; severity Moderate; reported by marten-seemann (2024-01-10). Analysis: https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation/. https://github.com/quic-go/quic-go/security/advisories/GHSA-ppxx-5m9h-6vxf

NRDAX-T0185 - Out-Of-Order Stream Reassembly OOM

2026-07-10T00:00:00Z

quinn-proto out-of-order stream reassembly memory exhaustion (GHSA-4w2j-m93h-cj5j / RUSTSEC-2026-0185, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/A:H, CWE-770; affected quinn-proto < 0.11.15, fixed 0.11.15). An unauthenticated remote peer floods one QUIC connection with small STREAM frames at escalating non-contiguous offsets and never sends offset 0, so the receiver's `Assembler` buffers every gapped fragment as a distinct un-coalescible entry that is never deliverable -> the reassembly buffer's per-fragment overhead grows unbounded (memory exhaustion / DoS). PUBLIC-CVE REPLICATION captured here as the attack wire signature only (loopback UDP mock; no real quinn endpoint stood up); the mock_retained_* counters are a wire-side proxy for the pinned receiver memory.

NRDAX-T0182 - Optimistic ACK Congestion Window Manipulation

2026-07-10T00:00:00Z

quiche optimistic-ACK congestion-window growth (CVE-2025-4820): a QUIC peer completes a handshake, initiates a congestion-controlled transfer toward itself, then sends ACK frames (type 0x02 / 0x03) acknowledging packet-number ranges AHEAD of what the sender has actually sent - pacing the artificial ACKs so the server sees a very low RTT and grows its CWND without bound, admitting more bytes in flight than the path supports (availability / bandwidth amplification). CVSS 3.1 = 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Affected quiche < 0.24.4; fixed 0.24.4. public-cve-replication - wire signature only (loopback mock plays the sender; this driver plays the attacker receiver emitting the optimistic/forward ACKs). The CWND-growth impact is a property of the vulnerable congestion controller, recorded here as advisory facts, not reproduced.

NRDAX-T0042 - Crypto Frame Reassembly Buffer Exhaustion

2026-07-10T00:00:00Z

quiche QUIC CRYPTO-frame flood (CVE-2024-1765): flood of QUIC long-header packets each carrying a CRYPTO frame (type 0x06) whose offset escalates by a fixed stride (4096) - leaving the crypto reassembly stream permanently non-contiguous so the receiver retains every out-of-order range - and whose declared length (4096) exceeds the truncated (200-byte) body delivered, so a modest packet rate reserves an unbounded, monotonically-growing crypto-reassembly buffer. Real CVE is post-handshake 1-RTT CRYPTO frames; a loopback mock cannot complete a real TLS 1.3 handshake, so the reassembly-buffer-growth wire signature is modelled on the QUIC long-header CRYPTO surface (frame type + escalating offsets + oversized declared span are the load-bearing artefacts). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected quiche <= 0.19.1, 0.20.0; fixed 0.19.2, 0.20.1; CVSS 3.1 5.9 (Moderate); reported by Marten Seemann. https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g

NRDAX-T0326 - Unbounded Peer-Slot Sybil

2026-07-09T00:00:00Z

Sybil (SlowMist Blockchain Common Vulnerability List): a flood of full RLPx+eth-handshake peers each with a DISTINCT node identity occupies the target's inbound peer slots and biases peer selection (eclipse precursor); accepted as full peers, unlike blank handshake floods or alien-chain pollution. SlowMist gap class; no CVE.

NRDAX-T0307 - Transaction Malleability

2026-07-09T00:00:00Z

Transaction Malleability (SlowMist Blockchain Common Vulnerability List): a tx and a malleated sibling with a byte-different scriptSig (extra OP_NOP) → different txid, identical inputs/outputs/effect; relaying both lets the mutant confirm under a new txid, breaking original-txid tracking (classic pre-SegWit malleability). SlowMist gap class; no CVE.

NRDAX-T0292 - Sync Height Manipulation Stall

2026-07-09T00:00:00Z

CVE-2025-24371 (ASA-2025-001 / GHSA-22qq-3xwm-r5x4): a malicious CometBFT blocksync peer disrupts a node's ability to sync. In blocksync a peer reports its base/latest heights in a StatusResponse; the attacker advertises an inflated `latest` (the sync target) then advertises LOWER heights. The target is never recalculated downward, so the node tries to catch up to an unreachable height indefinitely → blocksync deadlock (restarted/new nodes cannot rejoin). Affected cometbft <= v0.38.16 and v1.0.0; fixed v0.38.17, v1.0.1. Wire signature: StatusResponse frames whose `latest` spikes high then steps DOWN, plus BlockRequests answered only by NoBlockResponse on the Blocksync channel 0x40.

NRDAX-T0254 - Repair Protocol Legacy Request Stall

2026-07-09T00:00:00Z

Solana repair-protocol orphan DoS (solana-labs/solana v1.1.16, PR #10290): a legacy no-nonce RepairProtocol::Orphan(ContactInfo, slot) request for a slot > UNLOCK_NONCE_SLOT makes the serving node's serve_repair.rs::run_orphan loop through ALL slot metas in the blockstore building responses, 'effectively DOSing repair'. A tiny unauthenticated UDP orphan request over the serve_repair port thus commits the target to blockstore-proportional CPU (small request -> disproportionate server CPU, compute_amp). Fixed by breaking the loop when repair_response_packet returns None. Public release-note security fix, no CVE -> source_class = public-cve-replication.

NRDAX-T0246 - Rate-Limit Key Confusion

2026-07-09T00:00:00Z

IC ingress-pool per-NodeId quota mis-key (IC_N1_INGRESS_POOL_QUOTA_MISKEY): every HTTP-arriving ingress message buckets under the carrier replica's own NodeId instead of the signing principal (call.rs:391), so a single shared per-NodeId quota gates ALL public HTTP ingress. Submitting 10001 small signed HTTP ingress POSTs trips exceeds_limit (measured 0.04s at production caps 10000 / 100 MB); the handler's RemoveFromUnvalidated then purges 100% of legit unvalidated HTTP ingress on that replica at the next on_state_change (~200ms). PUBLIC reach; ~50k signed-ingress/s keeps a replica wiped; ~40 MB total bandwidth pins a 40-replica subnet. NullRabbit measurement; chains/ic/findings/IC_N1_INGRESS_POOL_QUOTA_MISKEY.

NRDAX-T0145 - Malformed HTTP Body Crash

2026-07-09T00:00:00Z

CVE-2026-41585 (GHSA-29x4-r6jv-ff4w): Zebra's JSON-RPC HTTP middleware treated a failure to read the incoming HTTP request body as an unrecoverable error, aborting the process instead of returning an error response. A client that opens the RPC HTTP connection, sends headers (Content-Length promising the full JSON-RPC body) plus only a PARTIAL body, then RSTs the socket mid-transfer (premature disconnect) crashes the node; an authenticated attacker repeats it to hold the node in a crash/restart loop -> availability DoS. Requires a client that can pass cookie auth (on by default). Affected: zebrad 2.2.0 .. <4.3.1 (through 4.3.0), zebra-rpc 1.0.0-beta.45 .. <6.0.2 (through 6.0.1). Fixed: zebrad 4.3.1 / zebra-rpc 6.0.2 (body-read failure now propagated as an ordinary error response).

NRDAX-T0071 - Ethash Verification Memory Exhaustion

2026-07-09T00:00:00Z

CVE-2021-42219: go-ethereum v1.10.9 (and earlier pre-Merge ethash-verifying geth) - an unauthenticated remote peer floods a node with an excessive amount of block/header messages; to verify each block's PoW geth must hold the ethash cache for that block's epoch (number // 30000; ~16 MB+ each, generated in consensus/ethash/algorithm.go), so a flood whose announced block numbers span many distinct epochs forces many large cache allocations -> memory exhaustion (the cache for the claimed epoch is generated BEFORE the invalid mixHash/nonce is rejected, so a bogus PoW still triggers the cost). Network-triggered, availability-only (CVSS 7.5, AV:N/A:H). No vendor GHSA; the ethash PoW path was removed at The Merge (Sept 2022), so this is a pre-Merge class. Faithful known-class replication of the flood wire signature; the OOM impact is the CVE's, not reproduced against a live node.

NRDAX-T0061 - Duplicate Tx Mempool Index Desync

2026-07-09T00:00:00Z

CVE-2023-34451 (GHSA-w24w-wp77-qffm): the mempool's list + map index each other and can desync so the SAME tx appears multiple times in the list and can no longer be fully removed (only a restart clears it) - a MempoolChannel(0x30) Txs message carrying the same tx repeated drives the duplicate-insertion path; flooding identical txs is the wire signature (fixed v0.34.29 / v0.37.2).

NRDAX-T0006 - Async Runtime Blocking VM Execution

2026-07-09T00:00:00Z

The simulateTransaction RPC handler executes the BPF VM synchronously on the calling Tokio worker thread (no spawn_blocking interposed), and because sigVerify defaults off and simulation is gas-free, an attacker can submit CU-maximizing transactions against pre-loaded programs at no cost. Each concurrent request pins a shared executor thread for the full simulation duration, so per-worker throughput degrades proportionally to concurrent request count, exhausting the bounded async worker pool and starving all other RPC handlers sharing it. The fix-class is interposing async offload (spawn_blocking / dedicated thread pool with backpressure) plus request-side CU/cost accounting for simulate calls, not just on-chain compute budgets.

NRDAX-T0369 - WebSocket Task Spawn Exhaustion

2026-07-08T00:00:00Z

NullRabbit source-traced H4 slow-read

NRDAX-T0202 - Peer Timestamp Skew Manipulation

2026-07-08T00:00:00Z

Timejacking (SlowMist Blockchain Common Vulnerability List; Culubas 2011): N peers advertise a version.timestamp skewed ~+70min (inside the AddTimeData ±70min acceptance window) → each peer's derived time-offset drags the node's median network-adjusted time → block-time (nTime/MTP) validation clock drift → stale-tip / block-rejection isolation. SlowMist gap class; no CVE.

NRDAX-T0056 - Duplicate Input Validation-Bypass Crash

2026-07-08T00:00:00Z

CVE-2018-17144: a block whose tx spends one outpoint twice (duplicate inputs); the 0.14 pre-relay optimization (PR#9049) skipped the duplicate-input check → assert(!coin.IsNull()) crash (0.14.x) / supply inflation (0.15.0-0.16.2). Fixed 0.16.3/0.17.0. Patched node rejects bad-txns-inputs-duplicate.

NRDAX-T0041 - Cross-Chain Peer Pool Pollution

2026-07-08T00:00:00Z

Alien Attack (SlowMist 'peer-pool pollution'): a same-family but DIFFERENT-chain peer completes the chain-agnostic RLPx ECIES handshake + devp2p Hello and is admitted to the eth handshake; the chain check (networkID/genesis) happens only at eth Status, AFTER the full handshake - so an alien (Ethereum mainnet identity vs the target's privnet) forces geth to spend the whole ECIES+Hello handshake before disconnecting on the mismatch. Flooding alien handshakes wastes handshake CPU + occupies connection slots (peer-pool pollution). Class disclosed by SlowMist (first found the Alien Attack); no CVE.

NRDAX-T0330 - Unbounded Signature Verification CPU Exhaustion

2026-07-07T00:00:00Z

Aptos POST /v1/transactions/batch verifies + JSON→native-converts EVERY element before the batch-size cap (default 10) rejects (transactions.rs:525) - cap-after-work. Unauth attacker POSTs N≫cap signed txs; 1 attacker × 4 conns → 391% CPU on a 4-core node, legit p99 +70-100x. NullRabbit measurement; chains/aptos/findings/APT_REST_BATCH_UNCAPPED_VEC.

NRDAX-T0328 - Unbounded Request Body Memory Exhaustion

2026-07-07T00:00:00Z

PRYSM_ATTESTER_SLASHING_PUBKEY_BURN (S4): POST /eth/v1/beacon/pool/attester_slashings_v2 decodes one AttesterSlashingElectra whose attesting_indices vector is capped only at the structural MaxValidatorsPerCommittee*MaxCommitteesPerSlot = 131,072 (attestation.go:259; no body cap, no rate-limit) then runs a per-index pubkey-deser/subgroup-check loop before the pairing short-circuits → 3.06 s/req cold-cache measured. NullRabbit-original on prysm HEAD; no CVE.

NRDAX-T0211 - Premature Processing Index-Out-Of-Range Panic

2026-07-07T00:00:00Z

GHSA-p7mv-53f2-4cwj (ASA-2024-011): a Precommit with a non-nil BlockID + an attached vote extension is handled BEFORE the ValidatorIndex is verified → out-of-range ValidatorIndex → index-out-of-range panic on the ValidatorSet lookup (CometBFT >=0.38, fixed v0.38.15).

NRDAX-T0198 - Peer List Sort CPU Amplification

2026-07-07T00:00:00Z

Cardano PeerSharing MsgShareRequest O(N log N) sort CPU amp: sortBy+hashWithSalt over the ~3000-peer known set per request (~170 us), no idle timeout (Codec.hs:160), no per-peer rate limit. One post-handshake connection flooding MsgShareRequest pins ~10-20% of a core; multi-attacker linear. NullRabbit measurement; chains/cardano/findings/H_CARDANO_4_PEERSHARING.

NRDAX-T0165 - Missing Zero-Guard Divide-By-Zero Halt

2026-07-07T00:00:00Z

GHSA-x5vx-95h7-rv4p (cosmos-sdk <=0.47.15/<=0.50.11): x/group PercentageDecisionPolicy.Allow does yesCount.Quo(totalPower) with no totalPower==0 guard; a proposal on a group whose weight is driven to 0 → division-by-zero panic during FinalizeBlock → CONSENSUS FAILURE / chain halt

NRDAX-T0156 - Mempool Pending Eviction Flood

2026-07-07T00:00:00Z

CVE-2022-23328 (go-ethereum, CVSS 7.5, all versions <1.10.13): an attacker node sends 5120 PENDING high-gas-price txns from ONE account that each fully spend the account's FULL BALANCE, in one eth Transactions (0x02→0x12) message. The high gas price purges the victim's pending mempool, and the 5120 same-account spend-all txns then occupy the pool → new txns can't enter → DoS. Sibling of CVE-2022-23327 (future-nonce flood) but a distinct pending-set spend-all vector. Fixed geth 1.10.13.

NRDAX-T0148 - Malformed KZG Proof Mismatch DoS

2026-07-07T00:00:00Z

CVE-2026-22868 (CVSS 7.5): a batch of EIP-4844 type-3 blob txs announced then delivered (PooledTransactions) with structurally-valid KZG sidecars whose commitment/proof (over blob A) mismatch the carried blob (B) - geth <1.16.8 runs the full KZG proof pairing on EVERY tx in the batch before any validity check, so a malicious peer forces per-tx cryptographic verification → CPU exhaustion/crash. Fixed abeb78c (break + disconnect on first KZG failure; core/txpool/validation.go + eth/fetcher/tx_fetcher.go)

NRDAX-T0143 - Malformed Field Gossip Before Validation

2026-07-07T00:00:00Z

GHSA-hrhf-2vcr-ghch (ASA-2025-003): a BitArray whose declared Bits does not match its Elems count (len(Elems) != ceil(Bits/64)) is processed in an invalid state and gossiped to peers before validation → network halt (VoteSetBits channel 0x23; fixed v0.38.19 / v0.37.16).

NRDAX-T0129 - Invalid Curve Point Panic

2026-07-07T00:00:00Z

CVE-2026-41584 (GHSA-452v-w3gx-72wg): a V5/NU5 tx whose Orchard action rk is the IDENTITY point [0x00;32] - a canonical point the spec allows, so it passes parse + hash() - but Orchard proof verification extracts the identity's affine coords and .unwrap()s (circuit.rs Instance::to_halo2_instance) → PANIC. Single unauth P2P tx crashes the node in verify. Fixed v4.3.1 / zebra-chain 6.0.2.

NRDAX-T0122 - Integer Signedness Index OOB Crash

2026-07-07T00:00:00Z

CVE-2021-3121 (gogoproto 'skippy peanut butter'): unknown length-delimited field with a negative-length varint → pre-1.3.2 skip code does iNdEx+=length with no length<0 check → index out of bounds → panic in the cosmos-sdk tx decoder, pre-signature-validation

NRDAX-T0101 - Handshake Crypto Validation Bypass Crash

2026-07-07T00:00:00Z

CVE-2025-24883: RLPx auth with an all-zero (off-curve) EC pubkey - geth <1.14.13 skips the secp256k1 point-validity check → handshake crypto crash (fixed 159fb1a)

NRDAX-T0038 - Count Underflow Header Serving Amplification

2026-07-07T00:00:00Z

CVE-2024-32972: eth GetBlockHeaders amount=0 → count-1 underflows to UINT64_MAX → bypasses maxHeadersServe → serves all headers to genesis → memory exhaustion (geth <1.13.15)

NRDAX-T0024 - Compact Block FillBlock Duplicate Crash

2026-07-07T00:00:00Z

CVE-2024-35202: blocktxn with txns not committed to the block merkle root → FillBlock called twice → assertion + node exit (Bitcoin Core <25.0)

NRDAX-T0207 - Pre-Verify Gossip Flood

2026-07-04T00:00:00Z

CometBFT consensus DataChannel(0x21) ProposalMessage flood: valid-shape Proposal passes ValidateBasic but the RLock+queue path runs before deferred sig-verify - the N1.4 family HEAD (vote-flood + blocksync-flood are its siblings). NullRabbit-original consensus-reactor measurement.

NRDAX-T0187 - Oversized Block Response Flood

2026-07-04T00:00:00Z

CometBFT BlocksyncChannel(0x40) oversized BlockResponse (up to 9000 CommitSigs, ~900KB): the Block decode + ValidateBasic at https://github.com/cometbft/cometbft/blob/v0.38.22/blocksync/reactor.go is the wedge. NullRabbit-original measurement.

NRDAX-T0064 - Endpoint Concurrency Cap Exhaustion

2026-07-04T00:00:00Z

cosmos-sdk server/grpc/server.go grpc.NewServer w/o grpc.MaxConcurrentStreams -> grpc-go default effectively unbounded + no SETTINGS_MAX_CONCURRENT_STREAMS signalled; attacker holds many HTTP/2 streams on one conn pinning per-stream state (~7KB) -> ~7GB single-source RSS pin (measured gaiad loopback). Sei fork sets MaxConcurrentStreams(100). COSMOS_SDK_GRPC_STREAM_FLOOD / C11.

NRDAX-T0352 - Unvalidated Field Length Panic

2026-07-03T00:00:00Z

Agave snapshot AppendVec StoredMeta.data_len > MAX_PERMITTED_DATA_LENGTH (10 MiB) survives new_for_startup (sanitize skipped) -> index-gen scan_accounts QuotaExceeded -> .expect("must scan accounts storage") panic; pre-hash-gate bootstrap crash. Out-of-scope per Anza SECURITY.md (maliciously-crafted-snapshots / bootstrap-config-mitigable) -> publishable. source_class=original.

NRDAX-T0291 - Subscription Permit Exhaustion

2026-07-03T00:00:00Z

C04 (COSMOS_SUBSCRIBE_PERCONN_CAP): CometBFT rpc/core/events.go:27 caps NumClients>=MaxSubscriptionClients(100) but clientID=RemoteAddr(ip:PORT) → each TCP conn gets an independent per-client cap → subscription multiplication across many connections from one IP

NRDAX-T0248 - Recursive Filter Expression CPU Blowup

2026-07-03T00:00:00Z

IOTA_S1_EVENTFILTER_EXPONENTIAL: iotax_subscribeEvent depth-D balanced Or-tree filter → exponential CPU

NRDAX-T0097 - gRPC/H2 Multiplexing OOM

2026-07-03T00:00:00Z

NullRabbit measurement (gRPC/h2 multiplex DoS).

NRDAX-T0171 - Nil Node Dereference Panic

2026-07-02T00:00:00Z

CVE-2020-26264: a crafted LES GetProofsV2 storage-proof request (non-empty AccKey for a non-existent account) dereferences a nil account trie in the les server's GetProofsV2 handler → panic/crash (geth <1.9.25). Delivered after a real LES Status handshake to a synced --light.serve node; a patched server serves it safely (ProofsV2 reply) - the malicious request reaches the exact vulnerable handler.

NRDAX-T0166 - Move Verifier Fixpoint CPU Exhaustion

2026-07-02T00:00:00Z

CertiK Skyfall HamsterWheel: crafted-CFG Move module defeats id_leak_verifier fixpoint → infinite re-analysis → CPU halt

NRDAX-T0142 - Malformed Bytecode Index Panic

2026-07-02T00:00:00Z

CertiK Skyfall: Publish RPC disassembles a malformed Move module (empty code_unit) → index panic → RPC crash

NRDAX-T0025 - Compact Block Size Integer Overflow

2026-07-02T00:00:00Z

CVE-2025-46597: cmpctblock declaring >1GB short-ids → 32-bit size-calc overflow

NRDAX-T0355 - Unvalidated Relay Map Memory Exhaustion

2026-07-01T00:00:00Z

CVE-2016-10724: pre-0.13.0 alert messages stored in an unbounded map → memory exhaustion

NRDAX-T0354 - Unvalidated Inventory Tracking Memory Exhaustion

2026-07-01T00:00:00Z

CVE-2018-17145 (INVDoS): random-hash INV flood → unbounded tx-tracking memory

NRDAX-T0350 - Unsolicited Block State Poisoning

2026-07-01T00:00:00Z

CVE-2024-52921: unrequested merkle-mismatched block erases other peers' download state → hinders propagation

NRDAX-T0345 - Unrated GetHeaders Response Flood

2026-07-01T00:00:00Z

CVE-2023-33297 (drain): un-rate-limited getheaders flood → >100MB/s upload (Bitcoin/Litecoin/Dogecoin)

NRDAX-T0331 - Unbounded Stream Backpressure OOM

2026-07-01T00:00:00Z

CVE-2022-23492/CVE-2022-23486: libp2p stream/connection exhaustion (no backpressure) → OOM

NRDAX-T0312 - Tx-Relay Throughput Jamming

2026-07-01T00:00:00Z

CVE-2024-55563 (Bitcoin Core <= 27.2): transaction-relay jamming via an off-chain protocol attack ('Transaction-Relay Throughput Overflow Attacks against Off-Chain Protocols'; related to CVE-2024-52913). High-overflow variant: a flood of many small higher-feerate txs + their inv announcements overflows the fee-rate-sorted forward-transaction inventory (INVENTORY_BROADCAST_MAX / CompareInvMempoolOrder), so a lower-feerate pre-signed Lightning HTLC/commitment tx is never announced (jammed) before its timelock expires -> HTLC outcome changed.

NRDAX-T0249 - Recursive Message Deserialisation Stack Overflow

2026-07-01T00:00:00Z

GHSA-8wcc-m6j2-qxvm (ASA-2024-0012/0013): deeply-nested protobuf Any → TxDecoder/UnpackAny stack-overflow / exponential CPU+mem in CheckTx (pre-validation)

NRDAX-T0206 - Pre-Handshake Packet Flood

2026-07-01T00:00:00Z

EL-2026-06 (EF public-disclosure): RLPx pre-auth packet flood → CPU/bandwidth exhaustion

NRDAX-T0184 - Orphan Tx Resolution CPU Amplification

2026-07-01T00:00:00Z

CVE-2024-52914: orphan-tx re-resolution O(outputs × 100 orphans) of expensive txs → multi-hour CPU stall

NRDAX-T0139 - Legacy Sighash Quadratic CPU Blowup

2026-07-01T00:00:00Z

CVE-2025-46598: non-standard tx with many legacy-sighash inputs → quadratic validation CPU, no peer penalty

NRDAX-T0131 - Invalid Message Log Flood

2026-07-01T00:00:00Z

CVE-2025-54605: flood of PoW-invalid blocks logged unconditionally → log/disk fill

NRDAX-T0124 - INV Flood GetHeaders Amplification

2026-07-01T00:00:00Z

CVE-2024-52915: INV with 50k items → 50k getheaders replies / send-buffer blowup

NRDAX-T0106 - Header-Length Preallocation OOM

2026-07-01T00:00:00Z

CVE-2015-3641: header length field pre-allocates the receive buffer before the body → per-connection OOM

NRDAX-T0099 - Half-Open Handshake Slowloris

2026-07-01T00:00:00Z

IC quic_transport half-open QUIC handshake memory pin (IC_QUIC_HALFOPEN_PIN): a burst of QUIC v1 Initial packets (distinct SCID each) whose CRYPTO frame declares a large TLS handshake length (4096) but delivers a truncated ClientHello (~200 B) leaves rustls 'incomplete, waiting', so each `Connecting` future lives to the pre-handshake timeout pinning ~100 KiB/conn. No Retry (EndpointConfig::default()), no per-IP UDP cap, mTLS only after state is committed. Measured on the real replica (release-2026-05-29_04-44-base, commit a47e543, 2026-06-02): n=200 -> +25.5 MiB (~128 KiB/conn), n=1000 -> +129 MiB (~132 KiB/conn), n=3000 -> +278 MiB (abs 420 MiB, ~95 KiB/conn); across 12,200 total connections ZERO were rejected at admission. MEDIUM/5.9 (bounded only by IC's default-deny firewall + 512 GiB replica RAM, not by any transport control). NullRabbit measurement; chains/ic/findings/IC_QUIC_HALFOPEN_PIN.

NRDAX-T0088 - GetData Request Flood

2026-07-01T00:00:00Z

CVE-2024-52920 class: oversized GETDATA processing load

NRDAX-T0076 - Expensive Debug RPC Compute Amplification

2026-07-01T00:00:00Z

debug_traceCall compute amplification (geth: debug API is DoS-prone, do not expose)

NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash

2026-07-01T00:00:00Z

CVE-2013-5700: empty BIP37 bloom filter → modulo-by-zero in CBloomFilter::Hash() → crash

NRDAX-T0342 - Unindexed Account Scan CPU Amplification

2026-06-30T00:00:00Z

E28/SOL_P07: getProgramAccounts filter-miss CPU scan (agave rpc.rs:2235-2251)

NRDAX-T0261 - RPC Request Flood

2026-06-30T00:00:00Z

eth RPC request-flood (full-tx block fetch sustained at high rate)

NRDAX-T0506 - Peer Ban Bypass Reconnection Flood

2026-01-01T00:00:00Z

Peer Ban Bypass Reconnection Flood

NRDAX-T0499 - Peer Record Signer Mismatch Poisoning

2026-01-01T00:00:00Z

Peer Record Signer Mismatch Poisoning

NRDAX-T0498 - Gossipsub Signature Binding Bypass

2026-01-01T00:00:00Z

Gossipsub Signature Binding Bypass

NRDAX-T0473 - Relay Reservation Refresh Memory Leak

2026-01-01T00:00:00Z

Relay Reservation Refresh Memory Leak

NRDAX-T0452 - Stale Cache After Fork State Corruption

2026-01-01T00:00:00Z

Stale Cache After Fork State Corruption

NRDAX-T0451 - Self-Spend Balance Overflow Panic

2026-01-01T00:00:00Z

Self-Spend Balance Overflow Panic

NRDAX-T0443 - Oversized Frame Stream Stall

2026-01-01T00:00:00Z

Oversized Frame Stream Stall

NRDAX-T0441 - Mempool Timeout Memory Leak

2026-01-01T00:00:00Z

Mempool Timeout Memory Leak

NRDAX-T0440 - Mempool Slot Exhaustion

2026-01-01T00:00:00Z

Mempool Slot Exhaustion

NRDAX-T0425 - Invalid UTF-8 Parsing Infinite Loop

2026-01-01T00:00:00Z

Invalid UTF-8 Parsing Infinite Loop

NRDAX-T0390 - QUIC Path Event Queue Exhaustion

2026-01-01T00:00:00Z

QUIC Path Event Queue Exhaustion

NRDAX-T0373 - WebTransport Stream Map Leak OOM

2026-01-01T00:00:00Z

WebTransport Stream Map Leak OOM

NRDAX-T0371 - WebTransport Close Handler Deadlock

2026-01-01T00:00:00Z

WebTransport Close Handler Deadlock

NRDAX-T0370 - WebTransport Capsule Memory Exhaustion

2026-01-01T00:00:00Z

WebTransport Capsule Memory Exhaustion

NRDAX-T0358 - URL Path Encoding Auth Bypass

2026-01-01T00:00:00Z

URL Path Encoding Auth Bypass

NRDAX-T0353 - Unvalidated Header Buffer OOM

2026-01-01T00:00:00Z

CVE-2024-52916: difficulty-1 headers with parent=genesis → mapBlockIndex unbounded growth → memory DoS

NRDAX-T0333 - Unbounded Subscription Flood

2026-01-01T00:00:00Z

NullRabbit source-traced IOTA GraphQL unbounded-subscription flood (operator-gated).

NRDAX-T0322 - Unbounded Deserialisation OOM

2026-01-01T00:00:00Z

Unbounded Deserialisation OOM

NRDAX-T0318 - Unauthenticated RPC Command Execution

2026-01-01T00:00:00Z

Unauthenticated RPC Command Execution

NRDAX-T0305 - TLS SNI mTLS Bypass

2026-01-01T00:00:00Z

TLS SNI mTLS Bypass

NRDAX-T0274 - Sigop Undercount Consensus Split

2026-01-01T00:00:00Z

Sigop Undercount Consensus Split

NRDAX-T0264 - Scope Permission Bypass Unauthorized Write

2026-01-01T00:00:00Z

Scope Permission Bypass Unauthorized Write

NRDAX-T0257 - Rogue-Key Aggregate Signature Forgery

2026-01-01T00:00:00Z

Rogue-Key Aggregate Signature Forgery

NRDAX-T0245 - QUIC Varint Parsing Panic

2026-01-01T00:00:00Z

QUIC Varint Parsing Panic

NRDAX-T0232 - QUIC/HTTP3 Header Memory Exhaustion

2026-01-01T00:00:00Z

QUIC/HTTP3 Header Memory Exhaustion

NRDAX-T0217 - QUIC Amplification Limit Bypass

2026-01-01T00:00:00Z

QUIC Amplification Limit Bypass

NRDAX-T0213 - Protocol Message CPU Burn

2026-01-01T00:00:00Z

Protocol Message CPU Burn

NRDAX-T0212 - Proof Verification Bypass

2026-01-01T00:00:00Z

Proof Verification Bypass

NRDAX-T0210 - Premature Disconnect Request Handling Crash

2026-01-01T00:00:00Z

Premature Disconnect Request Handling Crash

NRDAX-T0188 - Oversized Control-Message Array CPU Burn

2026-01-01T00:00:00Z

CVE-2026-49866: gossipsub oversized IHAVE/IWANT control-message arrays (huge messageID lists) → per-ID processing → CPU DoS

NRDAX-T0180 - OIDC Identity Verification Bypass

2026-01-01T00:00:00Z

OIDC Identity Verification Bypass

NRDAX-T0151 - Malformed Transaction Field Panic

2026-01-01T00:00:00Z

Malformed Transaction Field Panic

NRDAX-T0123 - Interlink Mismatch Consensus Failure

2026-01-01T00:00:00Z

Interlink Mismatch Consensus Failure

NRDAX-T0110 - HTTP Header Spoofing Trust Bypass

2026-01-01T00:00:00Z

The defect is geth's --http.vhosts allowlist treating an empty/absent Host header as implicitly trusted rather than explicitly denying it, combined with an HAProxy h2->h1 downgrade path that forwards HTTP/2 requests with an empty :authority as an empty Host instead of rejecting or filling it. An attacker with raw-h2 capability sends a request with :authority="" through the HAProxy front; HAProxy forwards it as empty Host while a normal forbidden hostname would be rejected with 403. The measurable effect is a 200 response bypassing the vhost/anti-DNS-rebinding allowlist, granting access that the Host-based authorization was meant to block.

NRDAX-T0104 - Hash Collision Forgery

2026-01-01T00:00:00Z

Hash Collision Forgery

NRDAX-T0102 - Handshake Key Validation Info Leak

2026-01-01T00:00:00Z

Handshake Key Validation Info Leak

NRDAX-T0083 - Frame Parsing Memory Amplification

2026-01-01T00:00:00Z

Frame Parsing Memory Amplification

NRDAX-T0079 - Field Element Comparison Bypass

2026-01-01T00:00:00Z

Field Element Comparison Bypass

NRDAX-T0049 - DHT PUT_VALUE Disk Exhaustion

2026-01-01T00:00:00Z

DHT PUT_VALUE Disk Exhaustion

NRDAX-T0048 - Dependency Use-After-Free Corruption

2026-01-01T00:00:00Z

Dependency Use-After-Free Corruption

NRDAX-T0008 - Authorization Check Bypass RCE

2026-01-01T00:00:00Z

Authorization Check Bypass RCE

NRDAX-T0380 - zkVM Guest Memory Safety

2025-01-01T00:00:00Z

zkVM Guest Memory Safety

NRDAX-T0335 - Unchecked Inherent Manipulation

2025-01-01T00:00:00Z

Unchecked Inherent Manipulation

NRDAX-T0329 - Unbounded RPC Response Amplification

2025-01-01T00:00:00Z

The node's JSON-RPC handler for batched account-lookup calls (e.g. getMultipleAccounts) imposes no response-size accounting or cost weighting relative to request size, only a flat cap on key count. An attacker submits a small request (~4.8KB) listing well-known large program accounts (Token/BPFLoader2/BPFLoaderUpgradeable), whose ELF/program data stubs are echoed in full, driving a single request to a ~17.8MB response (3,708x amplification) and sustained ~830MB/s egress under parallel workers. The fix-class is response-size-aware rate limiting/cost accounting on batched read RPCs (weighting by bytes returned, not just item count), not a request-count cap.

NRDAX-T0301 - TLS Certificate Parsing Crash

2025-01-01T00:00:00Z

TLS Certificate Parsing Crash

NRDAX-T0272 - Signer Index Overflow Crash

2025-01-01T00:00:00Z

Signer Index Overflow Crash

NRDAX-T0250 - Regex Schema Validation ReDoS

2025-01-01T00:00:00Z

Regex Schema Validation ReDoS

NRDAX-T0239 - QUIC Path Probe Nil-Pointer Crash

2025-01-01T00:00:00Z

QUIC Path Probe Nil-Pointer Crash

NRDAX-T0231 - QUIC Handshake State Confusion Crash

2025-01-01T00:00:00Z

QUIC Handshake State Confusion Crash

NRDAX-T0223 - QUIC Connection ID Retirement Infinite Loop

2025-01-01T00:00:00Z

QUIC Connection ID Retirement Infinite Loop

NRDAX-T0221 - QUIC Congestion Control Manipulation

2025-01-01T00:00:00Z

QUIC Congestion Control Manipulation

NRDAX-T0208 - Precompile Cryptographic Miscomputation

2025-01-01T00:00:00Z

Precompile Cryptographic Miscomputation

NRDAX-T0135 - L1 Finality Assumption Reorg

2025-01-01T00:00:00Z

L1 Finality Assumption Reorg

NRDAX-T0130 - Invalid Finality Signature Bypass

2025-01-01T00:00:00Z

Invalid Finality Signature Bypass

NRDAX-T0119 - Integer Overflow Decompression Infinite Loop

2025-01-01T00:00:00Z

Integer Overflow Decompression Infinite Loop

NRDAX-T0080 - Finality Justification Cache Bypass

2025-01-01T00:00:00Z

Finality Justification Cache Bypass

NRDAX-T0072 - Event Stream Endpoint Crash DoS

2025-01-01T00:00:00Z

Event Stream Endpoint Crash DoS

NRDAX-T0040 - Crafted Transaction Processing DoS

2025-01-01T00:00:00Z

Crafted Transaction Processing DoS

NRDAX-T0367 - Vote Extension Validation Panic

2024-01-01T00:00:00Z

Vote Extension Validation Panic

NRDAX-T0361 - Vesting Logic Exploit

2024-01-01T00:00:00Z

Vesting Logic Exploit

NRDAX-T0313 - Transaction Validation Logic Consensus Split

2024-01-01T00:00:00Z

Transaction Validation Logic Consensus Split

NRDAX-T0311 - Transaction Relay Suppression

2024-01-01T00:00:00Z

Transaction Relay Suppression

NRDAX-T0306 - Token Supply Inflation Bug

2024-01-01T00:00:00Z

Token Supply Inflation Bug

NRDAX-T0298 - Timestamp Integer Overflow Netsplit

2024-01-01T00:00:00Z

CVE-2024-52912: version nTime=INT64_MIN → abs64 overflow skews adjusted-network-time → netsplit

NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks

2024-01-01T00:00:00Z

CVE-2026-52737 (GHSA-gvjc-3w7c-92jx): a single unauthenticated Zcash P2P peer answers the syncing node's getblocks/FindBlocks with a two-hash inv, then serves a `block` whose coinbase height is above tip+VERIFICATION_PIPELINE_DROP_LIMIT. Zebra returns AboveLookaheadHeightLimit, which lacks the peer address, so it triggers a GLOBAL sync restart (~67s mainnet penalty, cancels all in-flight downloads) instead of banning the peer. Repeating the (inv -> above-lookahead block) cycle pins the node in a perpetual restart loop - sustained sync-degradation DoS from one unauth peer. Node does not crash. Affected zebrad<=4.4.1 / zebra-consensus<=6.0.0; fixed v4.5.0/7.0.0 (failures made peer-local + peer banned).

NRDAX-T0275 - Single-Peer Block-Discovery Stall

2024-01-01T00:00:00Z

CVE-2024-52922: cmpctblock announce then stall (never answer getblocktxn) → ~10min delayed propagation

NRDAX-T0226 - QUIC Crypto Frame Flood

2024-01-01T00:00:00Z

QUIC Crypto Frame Flood

NRDAX-T0222 - QUIC Connection ID Exhaustion

2024-01-01T00:00:00Z

QUIC Connection ID Exhaustion

NRDAX-T0194 - P2P Message Race Condition Crash

2024-01-01T00:00:00Z

P2P Message Race Condition Crash

NRDAX-T0192 - Oversized Transaction Block-Fill

2024-01-01T00:00:00Z

CVE-2019-11636 (Zcash 'Sapling Wood-Chipper'): Zcash 2.x raised the max transaction size from 100 KB to the full block size after Sapling, letting an attacker cheaply build block-filling shielded txs (fee 0.0001 ZEC/tx; ~0.0576 ZEC/day fills all ~576 daily blocks) and flood them onto the P2P network so no real transaction can be mined - a Slowloris-style asymmetric DoS on the whole chain. Fixed by reverting the max-tx-size cap to 100 KB (~10-40x cost). Modelled here as the P2P tx/inv flood wire signature; per-tx shielded-output count scaled down for capture.

NRDAX-T0183 - Orphan Transaction Processing DoS

2024-01-01T00:00:00Z

Orphan Transaction Processing DoS

NRDAX-T0181 - Onion Message Parsing OOM

2024-01-01T00:00:00Z

Onion Message Parsing OOM

NRDAX-T0160 - Message Field Integer Overflow OOM

2024-01-01T00:00:00Z

Message Field Integer Overflow OOM

NRDAX-T0152 - Malformed UPnP Response Infinite Loop

2024-01-01T00:00:00Z

Malformed UPnP Response Infinite Loop

NRDAX-T0144 - Malformed GETDATA Infinite Loop

2024-01-01T00:00:00Z

Malformed GETDATA Infinite Loop

NRDAX-T0114 - ICMP PMTUD Injection Disruption

2024-01-01T00:00:00Z

ICMP PMTUD Injection Disruption

NRDAX-T0026 - Compiler Execution Order Bug

2024-01-01T00:00:00Z

Compiler Execution Order Bug

NRDAX-T0022 - Client Library Supply Chain Compromise

2024-01-01T00:00:00Z

Client Library Supply Chain Compromise

NRDAX-T0001 - Addr Message Counter Overflow Crash

2024-01-01T00:00:00Z

CVE-2024-52919 (GHSA-qwp9-p9rr-h729): addr flood → CAddrMan 32-bit nIdCount overflow → assertion abort

NRDAX-T0286 - State Channel Replay Attack

2023-01-01T00:00:00Z

State Channel Replay Attack

NRDAX-T0285 - State Channel Logic Flaw

2023-01-01T00:00:00Z

State Channel Logic Flaw

NRDAX-T0263 - RPC Serialization Deadlock

2023-01-01T00:00:00Z

RPC Serialization Deadlock

NRDAX-T0238 - QUIC Path Challenge Flood

2023-01-01T00:00:00Z

QUIC Path Challenge Flood

NRDAX-T0214 - Protocol Message Flood Unbounded Goroutine

2023-01-01T00:00:00Z

CVE-2023-40591: post-Hello devp2p PING (0x02) flood → unbounded goroutines → OOM (geth 1.10.0-1.12.0)

NRDAX-T0199 - Peer-Record Flood OOM

2023-01-01T00:00:00Z

CVE-2023-40583: unchecked signed peer-record flood (peer-exchange) → go-libp2p peerstore OOM

NRDAX-T0126 - Inv Queue Draining CPU DoS

2023-01-01T00:00:00Z

Inv Queue Draining CPU DoS

NRDAX-T0112 - HTTP/2 Rapid Reset Stream Exhaustion

2023-01-01T00:00:00Z

CVE-2023-26964 (RUSTSEC-2023-0034): the Rust h2 crate < 0.3.17 does not release stream memory immediately on RST_STREAM and - pre-0.3.17 - has NO bound on streams in the pending-accept-but-remotely-reset state. An unauthenticated attacker cycles HEADERS(open stream)->RST_STREAM(cancel) faster than the application accepts requests off the queue; the queue grows unbounded -> excessive memory + CPU -> OOM (HTTP/2 Rapid Reset, CVE-2023-44487 class). Substrate/polkadot consumed h2 0.3.16 (indirect dep via hyper) on the node JSON-RPC HTTP server (jsonrpsee) and the prometheus monitoring endpoint until paritytech/substrate#13915 bumped it to 0.3.17. The fix (hyperium/h2#668) ADDS max_pending_accept_reset_streams and, on hitting the limit, sends GOAWAY(ENHANCE_YOUR_CALM) and errors the connection - behaviour the vulnerable versions lack, so a pre-0.3.17 server never issues GOAWAY. Network-triggered, availability-only (CVSS 7.5, AV:N/A:H). Faithful known-class replication of the HEADERS+RST_STREAM rapid-reset wire signature; the OOM impact is the CVE's, not reproduced against a live node. source_class=public-cve-replication. Distinct target from walrus_http2_rapid_reset (which is a walrus config disabling an EXISTING h2 limit; here the crate itself has no limit).

NRDAX-T0111 - HTTP/2 Rapid Reset Memory Exhaustion

2023-01-01T00:00:00Z

CVE-2025-8671 "MadeYouReset" (CVE-2025-55163 / GHSA-prj3-ccx8-p6x4 / VU#767506): an unauthenticated attacker opens an HTTP/2 stream (HEADERS, END_STREAM - a complete request) and then sends a protocol-valid-but-misused control frame - this driver uses WINDOW_UPDATE with a flow-control increment of 0 (a stream error PROTOCOL_ERROR per RFC 9113 §6.9.1) - which forces the SERVER to emit RST_STREAM. Because a reset stream is immediately no longer counted as active, the server's MAX_CONCURRENT_STREAMS ceiling (typ. 100) is never reached, yet the backend has already been handed the request and keeps processing it. Repeating the HEADERS+WINDOW_UPDATE(0) cycle floods the server with unbounded concurrent backend work -> memory/CPU exhaustion -> OOM / CPU-pin -> DoS (Tomcat manifests as OutOfMemoryError). This is DISTINCT from CVE-2023-44487 HTTP/2 Rapid Reset: there the CLIENT sends RST_STREAM, so the reset frames are inbound and rate-limitable; here the RST_STREAM is SERVER-emitted (outbound), so the post-CVE-2023-44487 client-side rapid-reset mitigations do not apply. Faithful known-class replication of the MadeYouReset wire signature (HEADERS+END_STREAM, then WINDOW_UPDATE with a zero increment, then a server-emitted RST_STREAM); the OOM/CPU impact is the CVE's, not reproduced against a live server. source_class=public-cve-replication. Distinct wire signature from the sibling rapid-reset drivers (walrus_http2_rapid_reset / substrate_h2_rapid_reset), which are CLIENT-emitted RST.

NRDAX-T0100 - Handshake Crypto CPU Burn

2023-01-01T00:00:00Z

Neodyme ND-FD1-MD-02: QUIC INITIAL flood → per-handshake x25519 + ed25519 sign-tile CPU exhaustion (compute-bound, distinct from the connection-slot flood)

NRDAX-T0098 - Guest Module Memory Corruption

2023-01-01T00:00:00Z

Guest Module Memory Corruption

NRDAX-T0095 - GraphQL Alias Query Amplification

2023-01-01T00:00:00Z

CVE-2023-42319: geth <=1.13.4 --http --graphql; a query with N aliased logs(filter:{fromBlock:0}) ops -> unbounded per-alias full-chain scan -> memory blowup

NRDAX-T0060 - Duplicate Transaction Memory Leak

2023-01-01T00:00:00Z

Duplicate Transaction Memory Leak

NRDAX-T0050 - DHT Sybil Content Censorship

2023-01-01T00:00:00Z

CVE-2023-26248 / GHSA-mqr9-hjr8-2m9w: Content Censorship in IPFS via Kademlia DHT abuse. The libp2p Kademlia DHT (go-libp2p-kad-dht (Go; as shipped in go-ipfs/kubo), affected go-libp2p-kad-dht <= 0.20.0 / go-ipfs (kubo) <= 0.18.1) stores/serves a CID's provider record at the peers whose peer IDs have the smallest XOR distance to the CID, with no defence against an attacker manufacturing peer IDs in that neighbourhood. An attacker grinds many Sybil peer IDs closer to a target CID than any honest peer and joins them to the DHT, so the Sybils become the k-closest set for that CID: honest ADD_PROVIDER records land on the Sybils (dropped) and honest GET_PROVIDERS lookups converge on the Sybils, which return no honest provider (only more Sybil CLOSER_PEERS). A small number of strategically placed Sybils makes any content undiscoverable network-wide. Unauthenticated - any peer. Impact: content censorship (NDSS 2024 / arXiv:2307.12212). Protocol Labs deployed detection+mitigation in a later libp2p DHT release.

NRDAX-T0044 - Data Limit Bypass State Bloat

2023-01-01T00:00:00Z

Data Limit Bypass State Bloat

NRDAX-T0374 - Witness Block Parsing DoS

2022-01-01T00:00:00Z

Witness Block Parsing DoS

NRDAX-T0359 - Verbose Logging Triggered Crash

2022-01-01T00:00:00Z

Verbose Logging Triggered Crash

NRDAX-T0348 - Unsafe Deserialization RCE

2022-01-01T00:00:00Z

Unsafe Deserialization RCE

NRDAX-T0332 - Unbounded Stream Resource Exhaustion

2022-01-01T00:00:00Z

CoreDNS DoQ stream slowloris (CVE-2025-47950 / GHSA-cvx7-x8pj-x2gw): CoreDNS' DNS-over-QUIC server created a new goroutine for every incoming QUIC stream with NO cap on concurrent streams/goroutines (1:1 stream->goroutine). The DoQ framing (RFC 9250: 2-octet big-endian length prefix per DNS message) reads that prefix and the body with blocking io.ReadFull() calls that have NO per-stream read deadline. A remote, unauthenticated attacker opens many QUIC streams (e.g. 60 conns x 256 streams = 15,360) and sends only 1 byte on each - the first byte of the length prefix - then stalls; each io.ReadFull blocks forever waiting for the second byte, pinning a worker goroutine, and once workers are exhausted every further stream still spawns a goroutine that blocks on a worker token, so goroutine/RSS grow without bound -> OOM-kill/crash (a QUIC-native slowloris), especially in memory-constrained containers. CVSS 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affects `quic://`-enabled Corefiles; no workaround; fixed v1.12.2 (max_streams default 256 + bounded worker_pool_size default 1024). Fix was incomplete - regression CVE-2026-32934 / GHSA-2wpx-qpw2-g5h5, fixed v1.14.3. PUBLIC-CVE REPLICATION - wire signature only (loopback UDP mock, no CoreDNS DoQ server stood up).

NRDAX-T0296 - Template Injection RCE

2022-01-01T00:00:00Z

Template Injection RCE

NRDAX-T0205 - Pre-Handshake Crypto CPU Burn

2022-01-01T00:00:00Z

Bitcoin Core BIP-324 v2 transport pre-auth CPU burn: the 64-byte inbound ellswift key triggers secp256k1 ellswift ECDH + HKDF-SHA256 BEFORE any auth/rate-limit; only the soft 125-inbound cap gates, accept path single-threaded. Churn of 64-byte-key connections pins a core. Measured HIGH on Bitcoin Core (55x p50/256x p99 honest-peer latency at 4 IPs) + Qtum; default-on since Core 27.0. NullRabbit measurement; chains/bitcoin/findings/BTC_V0_BIP324_PREHANDSHAKE_CPU.

NRDAX-T0191 - Oversized Script Validation Bypass

2022-01-01T00:00:00Z

Oversized Script Validation Bypass

NRDAX-T0155 - Mempool Flood Eviction

2022-01-01T00:00:00Z

Mempool Flood Eviction

NRDAX-T0118 - Integer Overflow Consensus Split

2022-01-01T00:00:00Z

Integer Overflow Consensus Split

NRDAX-T0116 - Incomplete Packet Timer Overflow CPU Burn

2022-01-01T00:00:00Z

Incomplete Packet Timer Overflow CPU Burn

NRDAX-T0037 - Contract Logic Validation Bypass

2022-01-01T00:00:00Z

Contract Logic Validation Bypass

NRDAX-T0021 - Claim Migration Fund Drain

2022-01-01T00:00:00Z

Claim Migration Fund Drain

NRDAX-T0015 - Chain ID Validation Missing

2022-01-01T00:00:00Z

Chain ID Validation Missing

NRDAX-T0003 - Arithmetic Bug Fund Miscalculation

2022-01-01T00:00:00Z

Arithmetic Bug Fund Miscalculation

NRDAX-T0362 - VM Integer Overflow Memory Corruption

2021-01-01T00:00:00Z

VM Integer Overflow Memory Corruption

NRDAX-T0343 - Uninitialized Buffer Memory Disclosure

2021-01-01T00:00:00Z

Uninitialized Buffer Memory Disclosure

NRDAX-T0304 - TLS Renegotiation Crash

2021-01-01T00:00:00Z

TLS Renegotiation Crash

NRDAX-T0267 - Signature Malleability Consensus Manipulation

2021-01-01T00:00:00Z

Signature Malleability Consensus Manipulation

NRDAX-T0258 - RPC Arbitrary File Write

2021-01-01T00:00:00Z

RPC Arbitrary File Write

NRDAX-T0255 - Transaction Replay Auth Bypass

2021-01-01T00:00:00Z

Transaction Replay Auth Bypass

NRDAX-T0178 - Null-Deref Crash via Crafted Input

2021-01-01T00:00:00Z

Null-Deref Crash via Crafted Input

NRDAX-T0176 - Nondeterministic Execution Consensus Split

2021-01-01T00:00:00Z

Nondeterministic Execution Consensus Split

NRDAX-T0140 - Log Injection RCE

2021-01-01T00:00:00Z

Log Injection RCE

NRDAX-T0078 - Fee-Bump Replacement Policy Bypass

2021-01-01T00:00:00Z

Fee-Bump Replacement Policy Bypass

NRDAX-T0075 - EVM Opcode/Precompile Semantics Divergence

2021-01-01T00:00:00Z

EVM Opcode/Precompile Semantics Divergence

NRDAX-T0074 - EVM Memory Corruption Consensus Split

2021-01-01T00:00:00Z

EVM Memory Corruption Consensus Split

NRDAX-T0073 - Evidence Timestamp Inconsistency DoS

2021-01-01T00:00:00Z

Evidence Timestamp Inconsistency DoS

NRDAX-T0070 - Ethash Cache Generation Memory Exhaustion

2021-01-01T00:00:00Z

Ethash Cache Generation Memory Exhaustion

NRDAX-T0063 - Dust Value Griefing

2021-01-01T00:00:00Z

Dust Value Griefing

NRDAX-T0062 - Dust Output Consensus Mishandling

2021-01-01T00:00:00Z

Dust Output Consensus Mishandling

NRDAX-T0028 - Compressed Message Decompression Crash

2021-01-01T00:00:00Z

Compressed Message Decompression Crash

NRDAX-T0007 - Authentication Message Replay

2021-01-01T00:00:00Z

Authentication Message Replay

NRDAX-T0505 - Rate-Limit Token Bypass Panic

2020-01-01T00:00:00Z

Rate-Limit Token Bypass Panic

NRDAX-T0504 - QUIC Pending Incoming Config Panic

2020-01-01T00:00:00Z

QUIC Pending Incoming Config Panic

NRDAX-T0503 - Gossip Dedup Bypass CPU Exhaustion

2020-01-01T00:00:00Z

Gossip Dedup Bypass CPU Exhaustion

NRDAX-T0502 - Unbounded Response Decode CPU Burn

2020-01-01T00:00:00Z

Unbounded Response Decode CPU Burn

NRDAX-T0501 - Oversized UDP Datagram Panic Crash

2020-01-01T00:00:00Z

Oversized UDP Datagram Panic Crash

NRDAX-T0500 - Gossip Backpressure Event-Loop Stall

2020-01-01T00:00:00Z

Gossip Backpressure Event-Loop Stall

NRDAX-T0497 - Chunk Header Arithmetic Overflow Panic

2020-01-01T00:00:00Z

Chunk Header Arithmetic Overflow Panic

NRDAX-T0496 - Unauthenticated Tx Signature Verification CPU Burn

2020-01-01T00:00:00Z

Unauthenticated Tx Signature Verification CPU Burn

NRDAX-T0495 - Stale Connection Resource Retention

2020-01-01T00:00:00Z

Stale Connection Resource Retention

NRDAX-T0494 - QUIC Handshake Queue Flood OOM

2020-01-01T00:00:00Z

QUIC Handshake Queue Flood OOM

NRDAX-T0493 - DNS NSEC3 CPU Exhaustion

2020-01-01T00:00:00Z

DNS NSEC3 CPU Exhaustion

NRDAX-T0492 - ByteStream Buffer Overflow Crash

2020-01-01T00:00:00Z

ByteStream Buffer Overflow Crash

NRDAX-T0491 - Unrequested Data Verification Hang

2020-01-01T00:00:00Z

Unrequested Data Verification Hang

NRDAX-T0490 - QUIC Path Close Race Panic Crash

2020-01-01T00:00:00Z

QUIC Path Close Race Panic Crash

NRDAX-T0489 - Ping Message Flood Resource Exhaustion

2020-01-01T00:00:00Z

Ping Message Flood Resource Exhaustion

NRDAX-T0488 - Gossip Unknown-Root Peer Bloat

2020-01-01T00:00:00Z

Gossip Unknown-Root Peer Bloat

NRDAX-T0487 - Writeset Retention Memory Exhaustion

2020-01-01T00:00:00Z

Writeset Retention Memory Exhaustion

NRDAX-T0486 - Snap Sync Boundary Node State Inflation

2020-01-01T00:00:00Z

Snap Sync Boundary Node State Inflation

NRDAX-T0485 - QUIC Handshake Wait Hang

2020-01-01T00:00:00Z

QUIC Handshake Wait Hang

NRDAX-T0484 - Gossip Verification TOCTOU Bypass

2020-01-01T00:00:00Z

Gossip Verification TOCTOU Bypass

NRDAX-T0483 - BlockPart Proof Validation Bypass

2020-01-01T00:00:00Z

BlockPart Proof Validation Bypass

NRDAX-T0482 - BlockPart Count/Size Validation Bypass

2020-01-01T00:00:00Z

BlockPart Count/Size Validation Bypass

NRDAX-T0481 - QUIC Initial Key Reuse Packet Injection

2020-01-01T00:00:00Z

QUIC Initial Key Reuse Packet Injection

NRDAX-T0480 - Duplicate Tx-Hash Message CPU Abuse

2020-01-01T00:00:00Z

Duplicate Tx-Hash Message CPU Abuse

NRDAX-T0479 - Discovery Lookup Hotspin CPU Burn

2020-01-01T00:00:00Z

Discovery Lookup Hotspin CPU Burn

NRDAX-T0478 - Blinded-Path Fee Division-By-Zero Crash

2020-01-01T00:00:00Z

Blinded-Path Fee Division-By-Zero Crash

NRDAX-T0477 - Unbounded Range Query Resource Exhaustion

2020-01-01T00:00:00Z

Unbounded Range Query Resource Exhaustion

NRDAX-T0476 - Stale Range Request Amplification

2020-01-01T00:00:00Z

Stale Range Request Amplification

NRDAX-T0475 - RPC Response Nil-Pointer Crash

2020-01-01T00:00:00Z

RPC Response Nil-Pointer Crash

NRDAX-T0474 - RPC Numeric Parameter Overflow Panic

2020-01-01T00:00:00Z

RPC Numeric Parameter Overflow Panic

NRDAX-T0472 - Range-Sync Self-Request Amplification

2020-01-01T00:00:00Z

Range-Sync Self-Request Amplification

NRDAX-T0471 - QUIC Stale Priority Retention DoS

2020-01-01T00:00:00Z

QUIC Stale Priority Retention DoS

NRDAX-T0470 - Oversized RPC Response OOM

2020-01-01T00:00:00Z

Oversized RPC Response OOM

NRDAX-T0469 - Mismatched Array-Length Panic

2020-01-01T00:00:00Z

Mismatched Array-Length Panic

NRDAX-T0468 - Invalid Chunk Retention Disk Exhaustion

2020-01-01T00:00:00Z

Invalid Chunk Retention Disk Exhaustion

NRDAX-T0467 - Integer Narrowing Cache Replay Amplification

2020-01-01T00:00:00Z

Integer Narrowing Cache Replay Amplification

NRDAX-T0466 - Handshake Identity Spoofing

2020-01-01T00:00:00Z

Handshake Identity Spoofing

NRDAX-T0465 - Gossipsub Stream Reset Registry Leak

2020-01-01T00:00:00Z

Gossipsub Stream Reset Registry Leak

NRDAX-T0464 - Gossipsub Message-Key Spoofing

2020-01-01T00:00:00Z

Gossipsub Message-Key Spoofing

NRDAX-T0463 - Gossip Statement Flood CPU Exhaustion

2020-01-01T00:00:00Z

Gossip Statement Flood CPU Exhaustion

NRDAX-T0462 - Gossip Shard Scan Budget Bypass CPU Burn

2020-01-01T00:00:00Z

Gossip Shard Scan Budget Bypass CPU Burn

NRDAX-T0461 - Gossip Message Nil-Pointer Crash

2020-01-01T00:00:00Z

Gossip Message Nil-Pointer Crash

NRDAX-T0460 - Gossip Message-ID Collision Suppression

2020-01-01T00:00:00Z

Gossip Message-ID Collision Suppression

NRDAX-T0459 - Gossip Counter Underflow OOM

2020-01-01T00:00:00Z

Gossip Counter Underflow OOM

NRDAX-T0458 - False-Positive Staleness Check Crash Loop

2020-01-01T00:00:00Z

False-Positive Staleness Check Crash Loop

NRDAX-T0457 - Deferred Payment Amplification DoS

2020-01-01T00:00:00Z

Deferred Payment Amplification DoS

NRDAX-T0456 - Config Nil-Pointer Panic Crash

2020-01-01T00:00:00Z

Config Nil-Pointer Panic Crash

NRDAX-T0455 - Blocksync Unverified Commit Acceptance

2020-01-01T00:00:00Z

Blocksync Unverified Commit Acceptance

NRDAX-T0454 - Blocksync Oversized Signature Count OOM

2020-01-01T00:00:00Z

Blocksync Oversized Signature Count OOM

NRDAX-T0453 - Blocksync Nil-Validator Crash

2020-01-01T00:00:00Z

Blocksync Nil-Validator Crash

NRDAX-T0450 - Relay Reservation Flood Resource Exhaustion

2020-01-01T00:00:00Z

Relay Reservation Flood Resource Exhaustion

NRDAX-T0449 - QUIC Zero-Length Datagram OOM

2020-01-01T00:00:00Z

QUIC Zero-Length Datagram OOM

NRDAX-T0448 - QUIC Retired Connection ID Queue Growth

2020-01-01T00:00:00Z

QUIC Retired Connection ID Queue Growth

NRDAX-T0447 - QUIC Remote Memory Exhaustion

2020-01-01T00:00:00Z

QUIC Remote Memory Exhaustion

NRDAX-T0446 - Precompile Cache Collision State Corruption

2020-01-01T00:00:00Z

Precompile Cache Collision State Corruption

NRDAX-T0445 - Ping Timeout Session Slot Leak

2020-01-01T00:00:00Z

Ping Timeout Session Slot Leak

NRDAX-T0444 - Peer Record Store Poisoning

2020-01-01T00:00:00Z

Peer Record Store Poisoning

NRDAX-T0442 - Missing Header Field Validation Gap

2020-01-01T00:00:00Z

Missing Header Field Validation Gap

NRDAX-T0439 - Justification Import Race Panic

2020-01-01T00:00:00Z

Justification Import Race Panic

NRDAX-T0438 - Header Flag Validation Bypass

2020-01-01T00:00:00Z

Header Flag Validation Bypass

NRDAX-T0437 - Gossipsub Peer-ID Spoofing Auth Bypass

2020-01-01T00:00:00Z

Gossipsub Peer-ID Spoofing Auth Bypass

NRDAX-T0436 - Future Message Buffer OOM

2020-01-01T00:00:00Z

Future Message Buffer OOM

NRDAX-T0435 - Fixed-Window Rate-Limit Boundary Bypass

2020-01-01T00:00:00Z

The gasless rate limiter (both consensus and local counters) buckets requests using a fixed-window key derived from truncated timestamp (commit_timestamp_ms/1000), rather than a sliding-window or token-bucket scheme, and this gate sits on the tx-submission path before signature verification. An attacker bursts up to max_tps just before window rollover and again immediately after, so no single window is ever exceeded but ~2x the intended throughput is admitted across the boundary. This yields unauthenticated, consensus-tier admission of double the configured rate, enabling free execution-resource consumption up to the gasless computation-unit cap.

NRDAX-T0434 - Malformed Proposal Field Panic

2020-01-01T00:00:00Z

Malformed Proposal Field Panic

NRDAX-T0433 - Unbounded Base58 Decode CPU Exhaustion

2020-01-01T00:00:00Z

Unbounded Base58 Decode CPU Exhaustion

NRDAX-T0432 - Entry Bytes Budget Reset Panic

2020-01-01T00:00:00Z

Entry Bytes Budget Reset Panic

NRDAX-T0431 - Epoch Sync Missing Data Consensus Divergence

2020-01-01T00:00:00Z

Epoch Sync Missing Data Consensus Divergence

NRDAX-T0430 - Snapshot Lifecycle Use-After-Free Crash

2020-01-01T00:00:00Z

Snapshot Lifecycle Use-After-Free Crash

NRDAX-T0429 - Gossip Topic Flood

2020-01-01T00:00:00Z

Gossip Topic Flood

NRDAX-T0428 - Vote Message Channel-Send Panic

2020-01-01T00:00:00Z

Vote Message Channel-Send Panic

NRDAX-T0427 - SSZ Fork Mismatch Nil-Deref

2020-01-01T00:00:00Z

SSZ Fork Mismatch Nil-Deref

NRDAX-T0426 - Sandbox Launcher Race Condition Hang

2020-01-01T00:00:00Z

Sandbox Launcher Race Condition Hang

NRDAX-T0424 - Hex Input Parsing Panic

2020-01-01T00:00:00Z

Hex Input Parsing Panic

NRDAX-T0423 - Gossip Bid Increment Spam CPU Burn

2020-01-01T00:00:00Z

Gossip Bid Increment Spam CPU Burn

NRDAX-T0422 - Mempool Transaction Heap Amplification

2020-01-01T00:00:00Z

Mempool Transaction Heap Amplification

NRDAX-T0421 - Yamux Oversized Frame Hang

2020-01-01T00:00:00Z

Yamux Oversized Frame Hang

NRDAX-T0420 - Stale Pending Block Cache DoS

2020-01-01T00:00:00Z

Stale Pending Block Cache DoS

NRDAX-T0419 - Snapshot Manifest Boundary Validation Crash

2020-01-01T00:00:00Z

Snapshot Manifest Boundary Validation Crash

NRDAX-T0418 - ENR Sequence Inflation Refresh DoS

2020-01-01T00:00:00Z

ENR Sequence Inflation Refresh DoS

NRDAX-T0416 - QUIC QLogger Nil-Pointer Crash

2020-01-01T00:00:00Z

QUIC QLogger Nil-Pointer Crash

NRDAX-T0415 - Post-Sync Block-Response Panic Crash

2020-01-01T00:00:00Z

Post-Sync Block-Response Panic Crash

NRDAX-T0413 - Duplicate Block Verification Deadlock

2020-01-01T00:00:00Z

Duplicate Block Verification Deadlock

NRDAX-T0412 - Silent State-Read Error Consensus Split

2020-01-01T00:00:00Z

Silent State-Read Error Consensus Split

NRDAX-T0410 - Gossip Message-ID Spoof Suppression

2020-01-01T00:00:00Z

Gossip Message-ID Spoof Suppression

NRDAX-T0406 - QUIC Certificate Validation Panic

2020-01-01T00:00:00Z

QUIC Certificate Validation Panic

NRDAX-T0405 - Oversized WASM Memory Grow Panic

2020-01-01T00:00:00Z

Oversized WASM Memory Grow Panic

NRDAX-T0404 - MEV Bid Double-Release Crash

2020-01-01T00:00:00Z

MEV Bid Double-Release Crash

NRDAX-T0402 - Burn Inflation Reward Mismatch Panic

2020-01-01T00:00:00Z

Burn Inflation Reward Mismatch Panic

NRDAX-T0397 - Missing State Metadata Panic Crash

2020-01-01T00:00:00Z

Missing State Metadata Panic Crash

NRDAX-T0395 - Fork Recovery Logic Exploit

2020-01-01T00:00:00Z

Fork Recovery Logic Exploit

NRDAX-T0393 - RPC Exception Log Amplification

2020-01-01T00:00:00Z

RPC Exception Log Amplification

NRDAX-T0391 - RPC Chunk Response Size Latency DoS

2020-01-01T00:00:00Z

RPC Chunk Response Size Latency DoS

NRDAX-T0385 - Invalid Block Disk Replay Exhaustion

2020-01-01T00:00:00Z

Invalid Block Disk Replay Exhaustion

NRDAX-T0379 - ZK Verifier Panic Crash

2020-01-01T00:00:00Z

ZK Verifier Panic Crash

NRDAX-T0377 - Zero-Length Field Panic Crash

2020-01-01T00:00:00Z

Zero-Length Field Panic Crash

NRDAX-T0376 - XML Namespace Declaration Memory Exhaustion

2020-01-01T00:00:00Z

XML Namespace Declaration Memory Exhaustion

NRDAX-T0375 - XML Attribute Parsing Quadratic CPU Exhaustion

2020-01-01T00:00:00Z

XML Attribute Parsing Quadratic CPU Exhaustion

NRDAX-T0372 - WebTransport Message Parsing Crash

2020-01-01T00:00:00Z

WebTransport Message Parsing Crash

NRDAX-T0368 - Vote Signature Late Verification Resource Exhaustion

2020-01-01T00:00:00Z

Vote Signature Late Verification Resource Exhaustion

NRDAX-T0366 - Vote Extension Power Mutation

2020-01-01T00:00:00Z

Vote Extension Power Mutation

NRDAX-T0365 - VM Stack Underflow Panic

2020-01-01T00:00:00Z

VM Stack Underflow Panic

NRDAX-T0364 - VM Stack Overflow Crash

2020-01-01T00:00:00Z

VM Stack Overflow Crash

NRDAX-T0363 - VM Resource Exhaustion OOM

2020-01-01T00:00:00Z

VM Resource Exhaustion OOM

NRDAX-T0360 - Vesting Account Creation Front-Running

2020-01-01T00:00:00Z

Vesting Account Creation Front-Running

NRDAX-T0356 - UPnP Gateway Event Panic Crash

2020-01-01T00:00:00Z

UPnP Gateway Event Panic Crash

NRDAX-T0346 - Unresolvable Finalized Block Wedge

2020-01-01T00:00:00Z

Unresolvable Finalized Block Wedge

NRDAX-T0344 - Uninitialized Memory Disclosure

2020-01-01T00:00:00Z

Uninitialized Memory Disclosure

NRDAX-T0341 - Unhandled RPC Error Panic

2020-01-01T00:00:00Z

Unhandled RPC Error Panic

NRDAX-T0340 - Unhandled Promise Rejection Crash

2020-01-01T00:00:00Z

Unhandled Promise Rejection Crash

NRDAX-T0339 - Unhandled Fork Event Panic

2020-01-01T00:00:00Z

Unhandled Fork Event Panic

NRDAX-T0336 - Unchecked Memory Write Panic

2020-01-01T00:00:00Z

Unchecked Memory Write Panic

NRDAX-T0334 - Unbounded Task Spawn Resource Exhaustion

2020-01-01T00:00:00Z

Unbounded Task Spawn Resource Exhaustion

NRDAX-T0325 - Unbounded Message Loop Halt

2020-01-01T00:00:00Z

Unbounded Message Loop Halt

NRDAX-T0324 - Unbounded Log Range Scan Amplification

2020-01-01T00:00:00Z

Unbounded Log Range Scan Amplification

NRDAX-T0320 - Unbounded Connection Flood

2020-01-01T00:00:00Z

CVE-2020-5303 (Lavender): unlimited CometBFT P2P connection requests → OOM + activeIDs-map saturation

NRDAX-T0316 - Unaligned Memory Access Crash

2020-01-01T00:00:00Z

Unaligned Memory Access Crash

NRDAX-T0315 - TxPool Message Flood OOM

2020-01-01T00:00:00Z

TxPool Message Flood OOM

NRDAX-T0314 - TxPool Crafted Transaction Crash

2020-01-01T00:00:00Z

TxPool Crafted Transaction Crash

NRDAX-T0310 - Tx Malleability Non-Consensus

2020-01-01T00:00:00Z

Tx Malleability Non-Consensus

NRDAX-T0309 - Tx History Storage Flood Disk Exhaustion

2020-01-01T00:00:00Z

Tx History Storage Flood Disk Exhaustion

NRDAX-T0308 - Transaction History Storage Exhaustion

2020-01-01T00:00:00Z

Transaction History Storage Exhaustion

NRDAX-T0302 - TLS Handshake Fragmentation Panic

2020-01-01T00:00:00Z

TLS Handshake Fragmentation Panic

NRDAX-T0300 - Timing Side-Channel Deanonymization

2020-01-01T00:00:00Z

Timing Side-Channel Deanonymization

NRDAX-T0299 - Timestamp Validation Panic Crash

2020-01-01T00:00:00Z

Timestamp Validation Panic Crash

NRDAX-T0297 - Timejacking Via Version Message

2020-01-01T00:00:00Z

Timejacking Via Version Message

NRDAX-T0294 - Sync State Deadlock Crash

2020-01-01T00:00:00Z

Sync State Deadlock Crash

NRDAX-T0293 - Sync Request Loop OOM

2020-01-01T00:00:00Z

Sync Request Loop OOM

NRDAX-T0290 - Subscription Failure Panic Crash

2020-01-01T00:00:00Z

Subscription Failure Panic Crash

NRDAX-T0289 - Stream Abort Race Crash

2020-01-01T00:00:00Z

Stream Abort Race Crash

NRDAX-T0288 - State Sync Proposer Priority Mismatch Chain Split

2020-01-01T00:00:00Z

State Sync Proposer Priority Mismatch Chain Split

NRDAX-T0287 - State Simulation Copy Panic

2020-01-01T00:00:00Z

State Simulation Copy Panic

NRDAX-T0284 - State Archive Restore Corruption Crash

2020-01-01T00:00:00Z

State Archive Restore Corruption Crash

NRDAX-T0283 - Stale State Reuse Crash

2020-01-01T00:00:00Z

Stale State Reuse Crash

NRDAX-T0282 - Staking Slashing Evasion

2020-01-01T00:00:00Z

Staking Slashing Evasion

NRDAX-T0281 - SSH Password Authentication Exposure

2020-01-01T00:00:00Z

SSH Password Authentication Exposure

NRDAX-T0278 - Snapshot File Parsing Crash

2020-01-01T00:00:00Z

Snapshot File Parsing Crash

NRDAX-T0277 - Snapshot Chunk Oversized OOM

2020-01-01T00:00:00Z

Snapshot Chunk Oversized OOM

NRDAX-T0276 - Slashing Implementation Crash

2020-01-01T00:00:00Z

Slashing Implementation Crash

NRDAX-T0273 - Signer Mismatch Bypass

2020-01-01T00:00:00Z

Signer Mismatch Bypass

NRDAX-T0271 - Signer Double-Sign Prevention Gap

2020-01-01T00:00:00Z

Signer Double-Sign Prevention Gap

NRDAX-T0270 - Signature Verification OOB Read

2020-01-01T00:00:00Z

Signature Verification OOB Read

NRDAX-T0268 - Signature Recovery CPU Burn

2020-01-01T00:00:00Z

Signature Recovery CPU Burn

NRDAX-T0266 - Shred Replay Processing DoS

2020-01-01T00:00:00Z

Shred Replay Processing DoS

NRDAX-T0265 - Secret Key Validation Missing

2020-01-01T00:00:00Z

Secret Key Validation Missing

NRDAX-T0262 - RPC Request Memory Leak

2020-01-01T00:00:00Z

RPC Request Memory Leak

NRDAX-T0259 - RPC Integer Overflow Memory Corruption

2020-01-01T00:00:00Z

RPC Integer Overflow Memory Corruption

NRDAX-T0256 - Replay Status Handling Panic

2020-01-01T00:00:00Z

Replay Status Handling Panic

NRDAX-T0253 - Reorg Unfiltered Tx Crash Loop

2020-01-01T00:00:00Z

Reorg Unfiltered Tx Crash Loop

NRDAX-T0252 - Reorg-Triggered Block Request Crash

2020-01-01T00:00:00Z

Reorg-Triggered Block Request Crash

NRDAX-T0251 - Reorg Batch Size Overflow Crash

2020-01-01T00:00:00Z

Reorg Batch Size Overflow Crash

NRDAX-T0247 - Recursive Callback Stack Overflow Crash

2020-01-01T00:00:00Z

Recursive Callback Stack Overflow Crash

NRDAX-T0244 - QUIC Unauthenticated Close Frame Disruption

2020-01-01T00:00:00Z

QUIC Unauthenticated Close Frame Disruption

NRDAX-T0243 - Quic Transport Parameter Overflow Panic

2020-01-01T00:00:00Z

Quic Transport Parameter Overflow Panic

NRDAX-T0242 - QUIC Socket Queue Spin CPU Burn

2020-01-01T00:00:00Z

QUIC Socket Queue Spin CPU Burn

NRDAX-T0241 - QUIC PTO Timer Overflow Crash

2020-01-01T00:00:00Z

QUIC PTO Timer Overflow Crash

NRDAX-T0240 - QUIC Post-Close Packet Processing Crash

2020-01-01T00:00:00Z

QUIC Post-Close Packet Processing Crash

NRDAX-T0237 - QUIC Packet Processing Infinite Loop

2020-01-01T00:00:00Z

QUIC Packet Processing Infinite Loop

NRDAX-T0236 - Quic Packet Loss Calculation Panic

2020-01-01T00:00:00Z

Quic Packet Loss Calculation Panic

NRDAX-T0235 - QUIC Malformed Packet Crash

2020-01-01T00:00:00Z

QUIC Malformed Packet Crash

NRDAX-T0234 - QUIC Invalid Length Field Panic

2020-01-01T00:00:00Z

QUIC Invalid Length Field Panic

NRDAX-T0233 - Quic Http3 Nil Pointer Crash

2020-01-01T00:00:00Z

Quic Http3 Nil Pointer Crash

NRDAX-T0230 - QUIC Empty Header Panic

2020-01-01T00:00:00Z

QUIC Empty Header Panic

NRDAX-T0229 - QUIC Early Data Processing Disclosure

2020-01-01T00:00:00Z

QUIC Early Data Processing Disclosure

NRDAX-T0228 - QUIC Decryption Overflow Crash

2020-01-01T00:00:00Z

QUIC Decryption Overflow Crash

NRDAX-T0227 - QUIC Datagram Fragmentation Panic

2020-01-01T00:00:00Z

QUIC Datagram Fragmentation Panic

NRDAX-T0224 - QUIC Connection Migration Duplicate-ID Crash

2020-01-01T00:00:00Z

QUIC Connection Migration Duplicate-ID Crash

NRDAX-T0220 - QUIC Close Frame Parsing Panic

2020-01-01T00:00:00Z

QUIC Close Frame Parsing Panic

NRDAX-T0219 - Quic Client Hello Fragmentation Panic

2020-01-01T00:00:00Z

Quic Client Hello Fragmentation Panic

NRDAX-T0218 - Quic Chunks Drop Panic Crash

2020-01-01T00:00:00Z

Quic Chunks Drop Panic Crash

NRDAX-T0216 - QUIC Accept Error Panic Crash

2020-01-01T00:00:00Z

QUIC Accept Error Panic Crash

NRDAX-T0215 - Quic 0-RTT Race Memory Exhaustion

2020-01-01T00:00:00Z

Quic 0-RTT Race Memory Exhaustion

NRDAX-T0209 - Predicate Verification Liveness DoS

2020-01-01T00:00:00Z

Predicate Verification Liveness DoS

NRDAX-T0204 - Pre-Handshake Buffer Reservation Exhaustion

2020-01-01T00:00:00Z

Pre-Handshake Buffer Reservation Exhaustion

NRDAX-T0201 - Peer Reputation Demotion Race Crash

2020-01-01T00:00:00Z

Peer Reputation Demotion Race Crash

NRDAX-T0200 - Peer Record Signature Bypass Impersonation

2020-01-01T00:00:00Z

Peer Record Signature Bypass Impersonation

NRDAX-T0197 - Payload Window Overflow Memory Exhaustion

2020-01-01T00:00:00Z

Payload Window Overflow Memory Exhaustion

NRDAX-T0193 - P2P Layer Memory Leak OOM

2020-01-01T00:00:00Z

P2P Layer Memory Leak OOM

NRDAX-T0190 - Oversized Hex String Parsing CPU Exhaustion

2020-01-01T00:00:00Z

Oversized Hex String Parsing CPU Exhaustion

NRDAX-T0189 - Oversized Field Buffer Overflow

2020-01-01T00:00:00Z

Oversized Field Buffer Overflow

NRDAX-T0186 - Oversized Block Execution Panic Crash

2020-01-01T00:00:00Z

Oversized Block Execution Panic Crash

NRDAX-T0179 - Numeric Field Parsing Memory Exhaustion

2020-01-01T00:00:00Z

Numeric Field Parsing Memory Exhaustion

NRDAX-T0177 - Notification Handle Drop CPU Exhaustion

2020-01-01T00:00:00Z

Notification Handle Drop CPU Exhaustion

NRDAX-T0175 - Nonce Sequencing Proposal Degradation

2020-01-01T00:00:00Z

Nonce Sequencing Proposal Degradation

NRDAX-T0174 - Non-Exploitable Cryptographic Defect

2020-01-01T00:00:00Z

Non-Exploitable Cryptographic Defect

NRDAX-T0173 - Nil Response Consensus Engine Panic

2020-01-01T00:00:00Z

Nil Response Consensus Engine Panic

NRDAX-T0172 - Nil Reference Panic Crash

2020-01-01T00:00:00Z

Nil Reference Panic Crash

NRDAX-T0170 - Network-Triggered Runtime DoS

2020-01-01T00:00:00Z

Network-Triggered Runtime DoS

NRDAX-T0169 - Network Reconnaissance Scanning

2020-01-01T00:00:00Z

Network Reconnaissance Scanning

NRDAX-T0168 - Network Partition Consensus Panic Crash

2020-01-01T00:00:00Z

Network Partition Consensus Panic Crash

NRDAX-T0167 - Nested Execution State Corruption

2020-01-01T00:00:00Z

Nested Execution State Corruption

NRDAX-T0164 - Missing Crypto Provider Panic Crash

2020-01-01T00:00:00Z

Missing Crypto Provider Panic Crash

NRDAX-T0162 - Metrics Endpoint Resource Exhaustion

2020-01-01T00:00:00Z

Metrics Endpoint Resource Exhaustion

NRDAX-T0161 - Metric Collection Panic Crash

2020-01-01T00:00:00Z

Metric Collection Panic Crash

NRDAX-T0159 - Merkle Trie Memory Leak

2020-01-01T00:00:00Z

Merkle Trie Memory Leak

NRDAX-T0157 - Mempool Sender Spoofing Resource Exhaustion

2020-01-01T00:00:00Z

Mempool Sender Spoofing Resource Exhaustion

NRDAX-T0154 - Mempool Deadlock DoS

2020-01-01T00:00:00Z

Mempool Deadlock DoS

NRDAX-T0153 - Mempool Computational Complexity DoS

2020-01-01T00:00:00Z

Mempool Computational Complexity DoS

NRDAX-T0149 - Malformed Protocol Message Crash

2020-01-01T00:00:00Z

Malformed Protocol Message Crash

NRDAX-T0147 - Malformed HTTP/3 Frame Crash

2020-01-01T00:00:00Z

Malformed HTTP/3 Frame Crash

NRDAX-T0146 - Malformed HTTP Header Parsing Crash

2020-01-01T00:00:00Z

Malformed HTTP Header Parsing Crash

NRDAX-T0138 - Leader Election Manipulation Panic

2020-01-01T00:00:00Z

Leader Election Manipulation Panic

NRDAX-T0137 - Latent Consensus Decision Panic

2020-01-01T00:00:00Z

Latent Consensus Decision Panic

NRDAX-T0136 - Large Trie Commit Batch Panic Crash

2020-01-01T00:00:00Z

Large Trie Commit Batch Panic Crash

NRDAX-T0134 - JSON Deserialization RCE

2020-01-01T00:00:00Z

JSON Deserialization RCE

NRDAX-T0133 - Iterator Length Mismatch Panic

2020-01-01T00:00:00Z

Iterator Length Mismatch Panic

NRDAX-T0132 - Invariant Check Spam CPU Exhaustion

2020-01-01T00:00:00Z

Invariant Check Spam CPU Exhaustion

NRDAX-T0128 - Invalid Commit Signature Halt

2020-01-01T00:00:00Z

Invalid Commit Signature Halt

NRDAX-T0127 - Invalid Address Nil-Pointer Crash

2020-01-01T00:00:00Z

Invalid Address Nil-Pointer Crash

NRDAX-T0121 - Integer Overflow Parsing Crash

2020-01-01T00:00:00Z

Integer Overflow Parsing Crash

NRDAX-T0117 - Index Out-Of-Bounds Panic Crash

2020-01-01T00:00:00Z

Index Out-Of-Bounds Panic Crash

NRDAX-T0115 - Implementation Divergence Chain Split

2020-01-01T00:00:00Z

Implementation Divergence Chain Split

NRDAX-T0113 - IBC Timeout Callback Reentrancy

2020-01-01T00:00:00Z

IBC Timeout Callback Reentrancy

NRDAX-T0108 - HTLC Replay Init Order Crash

2020-01-01T00:00:00Z

HTLC Replay Init Order Crash

NRDAX-T0105 - Hash Function Overflow Misbehavior

2020-01-01T00:00:00Z

Hash Function Overflow Misbehavior

NRDAX-T0103 - Handshake Version String Crash

2020-01-01T00:00:00Z

Handshake Version String Crash

NRDAX-T0094 - Governance Proposal Panic Halt

2020-01-01T00:00:00Z

Governance Proposal Panic Halt

NRDAX-T0093 - Gossipsub Mcache Config Panic Crash

2020-01-01T00:00:00Z

Gossipsub Mcache Config Panic Crash

NRDAX-T0092 - Gossip Query Triggered DB Crash

2020-01-01T00:00:00Z

Gossip Query Triggered DB Crash

NRDAX-T0091 - Gossip Message Quarantine Crash

2020-01-01T00:00:00Z

Gossip Message Quarantine Crash

NRDAX-T0090 - Gossip Message Deadlock Stall

2020-01-01T00:00:00Z

Gossip Message Deadlock Stall

NRDAX-T0089 - Gossip Attestation Index OOM

2020-01-01T00:00:00Z

Gossip Attestation Index OOM

NRDAX-T0087 - Genesis Migration Timing Panic

2020-01-01T00:00:00Z

Genesis Migration Timing Panic

NRDAX-T0086 - Gas Price Margin Integer Overflow

2020-01-01T00:00:00Z

Gas Price Margin Integer Overflow

NRDAX-T0085 - Gas Limit Capacity Exhaustion

2020-01-01T00:00:00Z

Gas Limit Capacity Exhaustion

NRDAX-T0084 - Gas Accounting Panic Bypass

2020-01-01T00:00:00Z

Gas Accounting Panic Bypass

NRDAX-T0082 - Forged Commit Future Height Light Client Attack

2020-01-01T00:00:00Z

Forged Commit Future Height Light Client Attack

NRDAX-T0081 - Force-Retire Integer Overflow Crash

2020-01-01T00:00:00Z

Force-Retire Integer Overflow Crash

NRDAX-T0077 - Fast Sync Pivot Failure Abort

2020-01-01T00:00:00Z

Fast Sync Pivot Failure Abort

NRDAX-T0069 - Equivocation Storm Liveness DoS

2020-01-01T00:00:00Z

Equivocation Storm Liveness DoS

NRDAX-T0068 - Equivocation Evidence Window Bypass

2020-01-01T00:00:00Z

Equivocation Evidence Window Bypass

NRDAX-T0067 - Epoch Height Source Lag Stall

2020-01-01T00:00:00Z

Epoch Height Source Lag Stall

NRDAX-T0066 - Epoch Boundary Crash Loop

2020-01-01T00:00:00Z

Epoch Boundary Crash Loop

NRDAX-T0065 - Engine API Deadlock

2020-01-01T00:00:00Z

Engine API Deadlock

NRDAX-T0058 - Duplicate Record Constraint Crash

2020-01-01T00:00:00Z

Duplicate Record Constraint Crash

NRDAX-T0057 - Duplicate Proof Memory Leak DoS

2020-01-01T00:00:00Z

Duplicate Proof Memory Leak DoS

NRDAX-T0054 - DNSSEC Validation Bypass Cache Poisoning

2020-01-01T00:00:00Z

DNSSEC Validation Bypass Cache Poisoning

NRDAX-T0053 - DNS Response Parsing Panic Crash

2020-01-01T00:00:00Z

DNS Response Parsing Panic Crash

NRDAX-T0052 - DNS Rebinding SSRF Bypass

2020-01-01T00:00:00Z

DNS Rebinding SSRF Bypass

NRDAX-T0051 - Dial Worker Panic Crash

2020-01-01T00:00:00Z

Dial Worker Panic Crash

NRDAX-T0047 - Default Secret Token Forgery

2020-01-01T00:00:00Z

Default Secret Token Forgery

NRDAX-T0045 - Declare Transaction Compilation CPU Exhaustion

2020-01-01T00:00:00Z

Declare Transaction Compilation CPU Exhaustion

NRDAX-T0043 - Crypto Input Panic Crash

2020-01-01T00:00:00Z

Crypto Input Panic Crash

NRDAX-T0039 - Crafted Packet Node Crash

2020-01-01T00:00:00Z

Crafted Packet Node Crash

NRDAX-T0036 - Contract Execution Engine Crash

2020-01-01T00:00:00Z

Contract Execution Engine Crash

NRDAX-T0035 - Contract Activation Compute Exhaustion

2020-01-01T00:00:00Z

Contract Activation Compute Exhaustion

NRDAX-T0033 - Consensus Message Crash DoS

2020-01-01T00:00:00Z

Consensus Message Crash DoS

NRDAX-T0032 - Consensus Future Vote OOM

2020-01-01T00:00:00Z

Consensus Future Vote OOM

NRDAX-T0031 - Consensus Deadlock Vote Race

2020-01-01T00:00:00Z

Consensus Deadlock Vote Race

NRDAX-T0030 - Connection Failure Panic Crash

2020-01-01T00:00:00Z

Connection Failure Panic Crash

NRDAX-T0029 - Concurrent RPC Race Nil-Deref Panic

2020-01-01T00:00:00Z

Concurrent RPC Race Nil-Deref Panic

NRDAX-T0027 - Compressed Message Checksum Bypass

2020-01-01T00:00:00Z

Compressed Message Checksum Bypass

NRDAX-T0020 - Checkpoint Snapshot Signer Bypass

2020-01-01T00:00:00Z

Checkpoint Snapshot Signer Bypass

NRDAX-T0019 - Channel Open Error Bypass

2020-01-01T00:00:00Z

Channel Open Error Bypass

NRDAX-T0018 - Channel Close State Race Stranding

2020-01-01T00:00:00Z

Channel Close State Race Stranding

NRDAX-T0016 - ChainSync Jumping Protocol DoS

2020-01-01T00:00:00Z

ChainSync Jumping Protocol DoS

NRDAX-T0014 - Certificate Revocation Bypass

2020-01-01T00:00:00Z

Certificate Revocation Bypass

NRDAX-T0012 - Block Timestamp Validation Bypass

2020-01-01T00:00:00Z

Block Timestamp Validation Bypass

NRDAX-T0011 - Block Replay Race Crash

2020-01-01T00:00:00Z

Block Replay Race Crash

NRDAX-T0010 - Block Processing Use-After-Free Crash

2020-01-01T00:00:00Z

Block Processing Use-After-Free Crash

NRDAX-T0004 - Arithmetic Edge-Case Panic Crash

2020-01-01T00:00:00Z

Arithmetic Edge-Case Panic Crash

NRDAX-T0378 - ZK Proof Forgery Acceptance

2019-01-01T00:00:00Z

ZK Proof Forgery Acceptance

NRDAX-T0269 - Signature Verification Bypass

2019-01-01T00:00:00Z

Signature Verification Bypass

NRDAX-T0141 - Low-Fee Transaction Spam Flood

2019-01-01T00:00:00Z

Low-Fee Transaction Spam Flood

NRDAX-T0107 - Headers Message Flood OOM

2019-01-01T00:00:00Z

Headers Message Flood OOM

NRDAX-T0046 - Decompression Bomb Resource Exhaustion

2019-01-01T00:00:00Z

quic-go HTTP/3 QPACK decompression-bomb memory exhaustion (CVE-2025-64702): a flood of QUIC v1 short-header (1-RTT) packets, each carrying a STREAM frame (type 0x0b) on a fresh client bidi stream whose data is an HTTP/3 HEADERS frame (type 0x01) holding a QPACK block: field-section prefix 00 00 (static-only) + 128 Indexed Field Line refs to static index 85 ('content-security-policy: script-src 'none'; object-src 'none'; base-uri 'none'', 76 B) encoded as the 2 bytes 'ff 16' each. Each ref is 2 wire bytes but decodes to a 108-byte field-section entry, so a 258-byte block decodes to 13824 B (~54x, the advisory's ~50x). MODELLED AS A REPEATABLE FLOW: the CVE describes one crafted frame, but the learnable artefact is many such HEADERS frames across many fresh request streams driving SUSTAINED decoder allocation (pre-v0.57.0 there is no SETTINGS_MAX_FIELD_SECTION_SIZE cap, so the expanded field section is allocated per stream without bound). A loopback mock cannot complete a real TLS 1.3 handshake, so the load-bearing wire artefacts modelled are the HEADERS/QPACK frame structure, the static-index density, and the small-on-wire / large-decoded ratio across a stream flood (not real QUIC keys / 1-RTT crypto). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected quic-go <= v0.56.0; fixed v0.57.0; severity Moderate (CVSS 5.3); reported by sfoxio (2025-12-11). https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6

NRDAX-T0034 - Container Escape via Dependency

2019-01-01T00:00:00Z

Container Escape via Dependency

NRDAX-T0017 - Channel Access Control Bypass

2019-01-01T00:00:00Z

Channel Access Control Bypass

NRDAX-T0005 - Array Deserialization Memcpy Corruption

2019-01-01T00:00:00Z

CVE-2018-3972 (TALOS-2018-0637): Levin array-of-arrays (0x8D) → epee read_ae POD memcpy → memory corruption

NRDAX-T0347 - Unsafe Deserialization Memory Corruption

2018-01-01T00:00:00Z

Unsafe Deserialization Memory Corruption

NRDAX-T0337 - Unexploitable Dependency Vulnerability

2018-01-01T00:00:00Z

Unexploitable Dependency Vulnerability

NRDAX-T0317 - Unauthenticated Admin Interface Exposure

2018-01-01T00:00:00Z

Black Valentine (SlowMist Blockchain Common Vulnerability List): geth --http with the personal namespace exposed + an unlocked/unlockable account → remote unauthenticated personal_unlockAccount then eth_sendTransaction flood drains the wallet. No CVE.

NRDAX-T0260 - RPC Parameter Validation Defect

2018-01-01T00:00:00Z

RPC Parameter Validation Defect

NRDAX-T0163 - Mining Pool Auth Bypass

2018-01-01T00:00:00Z

Mining Pool Auth Bypass

NRDAX-T0125 - Inv Message Flood OOM

2018-01-01T00:00:00Z

Inv Message Flood OOM

NRDAX-T0120 - Integer-Overflow Panic Control Message

2018-01-01T00:00:00Z

CVE-2026-34219 (+CVE-2026-33040): gossipsub ControlPrune backoff≈u64::MAX → Instant/Duration overflow panic

NRDAX-T0055 - Duplicate-Input Block Crash

2018-01-01T00:00:00Z

Duplicate-Input Block Crash

NRDAX-T0279 - SOCKS Proxy Remote Code Execution

2017-01-01T00:00:00Z

SOCKS Proxy Remote Code Execution

NRDAX-T0158 - Merkle Proof Forgery

2017-01-01T00:00:00Z

Merkle Proof Forgery

NRDAX-T0109 - HTTP API Connection Hang DoS

2017-01-01T00:00:00Z

HTTP API Connection Hang DoS

NRDAX-T0319 - Unbounded Alert Map OOM

2016-01-01T00:00:00Z

Unbounded Alert Map OOM

NRDAX-T0002 - Alert Message Ordering Bypass

2016-01-01T00:00:00Z

Alert Message Ordering Bypass

NRDAX-T0357 - UPnP Response Buffer Overflow

2015-01-01T00:00:00Z

UPnP Response Buffer Overflow

NRDAX-T0303 - TLS Handshake MITM Injection

2014-01-01T00:00:00Z

TLS Handshake MITM Injection

NRDAX-T0150 - Malformed SOCKS Response Infinite Loop

2013-01-01T00:00:00Z

Malformed SOCKS Response Infinite Loop