NRDAX-T0323 - Unbounded Filter Subscription Storage Exhaustion
Pending classification · active · first seen 2026-08-20
Producer label: subscription_exhaustion. Not yet assigned a mechanism family.
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
Besu FilterRepository stores all installed log/block/pending-tx filters in an unbounded ConcurrentHashMap, so eth_newFilter can be called without limit by an unauthenticated caller and each call retains server-side state. Fixed in 26.7.1, which caps active filters and returns -32005 past the cap (boundary MEASURED 2026-08-20 against 26.6.0/26.7.0/26.7.1/26.8.0, not taken from the advisory text).
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| ethereum | besu_unbounded_filter_repository | lab | reverse-engineered-cve | besu_unbounded_filter_repository | GHSA-vff7-xxjc-rccp ↗ |
references
cite
https://nrdax.com/techniques/NRDAX-T0323
NRDAX Registry. Technique NRDAX-T0323.
@misc{nrdax_NRDAX_T0323,
title = {Unbounded Filter Subscription Storage Exhaustion (NRDAX-T0323)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0323},
} {
"id": "nrdax-NRDAX-T0323",
"type": "dataset",
"title": "Unbounded Filter Subscription Storage Exhaustion (NRDAX-T0323)",
"URL": "https://nrdax.com/techniques/NRDAX-T0323",
"publisher": "NRDAX Registry"
} 
[](https://nrdax.com/techniques/NRDAX-T0323-unbounded-filter-subscription-storage-exhaustion)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0323nrdax cite NRDAX-T0323 --format bibtex