NRDAX-T0320 - Unbounded Connection Flood

connection_exhaustion · active · first seen 2020-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2020-5303 (Lavender): unlimited CometBFT P2P connection requests → OOM + activeIDs-map saturation

instances (6)

chain	primitive	fidelity	origin	reproducer (bundle)	source
cosmos	cosmos_p2p_conn_flood	lab	reverse-engineered-cve	cosmos_p2p_conn_flood	https://github.com/tendermint/tendermint/security/advisories/GHSA-v24h-pjjv-mcp6 ↗
ethereum	geth_tcp_handshake_flood	lab	reverse-engineered-cve	geth_tcp_handshake_flood	reports.immunefi.com ↗
libp2p	libp2p_conn_resource_exhaustion	lab	reverse-engineered-cve	libp2p_conn_resource_exhaustion	https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv ↗
monero	monero_rpc_conn_exhaustion	lab	reverse-engineered-cve	monero_rpc_conn_exhaustion	https://nvd.nist.gov/vuln/detail/CVE-2025-26819 ↗
quic	dnsdist_doq_concurrent_conn_exhaustion	lab	reverse-engineered-cve	dnsdist_doq_concurrent_conn_exhaustion	-
solana	firedancer_metrics_flood_crash	lab	reverse-engineered-cve	firedancer_metrics_flood_crash	github.com ↗

references

cve: CVE-2020-5303

vendor-advisory: GHREL-solana-labs-solana-v1.3.20

related (connection_exhaustion)

NRDAX-T0041 - Cross-Chain Peer Pool Pollution active NRDAX-T0064 - Endpoint Concurrency Cap Exhaustion active NRDAX-T0088 - GetData Request Flood active NRDAX-T0099 - Half-Open Handshake Slowloris active NRDAX-T0100 - Handshake Crypto CPU Burn active NRDAX-T0145 - Malformed HTTP Body Crash active NRDAX-T0206 - Pre-Handshake Packet Flood active NRDAX-T0214 - Protocol Message Flood Unbounded Goroutine active

cite

https://nrdax.com/techniques/NRDAX-T0320

plain

NRDAX Registry. Technique NRDAX-T0320.

bibtex

@misc{nrdax_NRDAX_T0320,
  title = {Unbounded Connection Flood (NRDAX-T0320)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0320},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0320",
  "type": "dataset",
  "title": "Unbounded Connection Flood (NRDAX-T0320)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0320",
  "publisher": "NRDAX Registry"
}