NRDAX-T0101 - Handshake Crypto Validation Bypass Crash
Fault termination · P2P and gossip · absent invariant · active · first seen 2026-07-07
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
CVE-2025-24883: RLPx auth with an all-zero (off-curve) EC pubkey - geth <1.14.13 skips the secp256k1 point-validity check → handshake crypto crash (fixed 159fb1a)
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| ethereum | geth_auth_zero_pubkey | lab | reverse-engineered-cve | geth_auth_zero_pubkey | GHSA-q26p-9cq4-7fc2 ↗ |
related (Fault termination)
NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0024 - Compact Block FillBlock Duplicate Crash active NRDAX-T0056 - Duplicate Input Validation-Bypass Crash active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0122 - Integer Signedness Index OOB Crash active NRDAX-T0129 - Invalid Curve Point Panic active
cite
https://nrdax.com/techniques/NRDAX-T0101
plain
NRDAX Registry. Technique NRDAX-T0101.
bibtex
@misc{nrdax_NRDAX_T0101,
title = {Handshake Crypto Validation Bypass Crash (NRDAX-T0101)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0101},
} json (csl)
{
"id": "nrdax-NRDAX-T0101",
"type": "dataset",
"title": "Handshake Crypto Validation Bypass Crash (NRDAX-T0101)",
"URL": "https://nrdax.com/techniques/NRDAX-T0101",
"publisher": "NRDAX Registry"
} badge
[](https://nrdax.com/techniques/NRDAX-T0101-handshake-crypto-validation-bypass-crash)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0101nrdax cite NRDAX-T0101 --format bibtex