NRDAX
Submit

← registry

NRDAX-T0328 - Unbounded Request Body Memory Exhaustion

compute_amp · active · first seen 2026-07-07

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

PRYSM_ATTESTER_SLASHING_PUBKEY_BURN (S4): POST /eth/v1/beacon/pool/attester_slashings_v2 decodes one AttesterSlashingElectra whose attesting_indices vector is capped only at the structural MaxValidato

instances (6)

chainprimitivefidelityoriginreproducer (bundle)source
cardano cardano_submit_api_body_memory_pin lab NullRabbit Labs cardano_submit_api_body_memory_pin github.com ↗
ethereum prysm_attester_slashing_pubkey_burn lab NullRabbit Labs prysm_attester_slashing_pubkey_burn chains/ethereum/findings/PRYSM_ATTESTER_SLASHING_PUBKEY_BURN/README.md
ethereum prysm_bls_exec_change_decode_burn lab NullRabbit Labs prysm_bls_exec_change_decode_burn chains/ethereum/findings/PRYSM_BLS_EXEC_CHANGE_DECODE_BURN/README.md
ethereum prysm_bls_pool_decode_burn lab NullRabbit Labs prysm_bls_pool_decode_burn chains/ethereum/findings/PRYSM_BLS_POOL_DECODE_BURN/README.md
ethereum reth_pooledtx_decode_memory_amp lab NullRabbit Labs reth_pooledtx_decode_memory_amp github.com ↗
ic ic_orchestrator_cup_body_bomb lab NullRabbit Labs ic_orchestrator_cup_body_bomb dfinity/ic rs/orchestrator/src/catch_up_package_provider.rs:343-372 (timeout(self.backoff, res.into_body().collect()) — no http_body_util::Limited byte cap; secondary site rs/canister_client/src/http_client.rs:302)

references

vendor-advisory: GHPR-monero-project-monero-10139
vendor-advisory: GHPR-tronprotocol-java-tron-6658
vendor-advisory: GHPR-tronprotocol-java-tron-6728

related (compute_amp)

NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0006 - Async Runtime Blocking VM Execution active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0076 - Expensive Debug RPC Compute Amplification active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0122 - Integer Signedness Index OOB Crash active NRDAX-T0129 - Invalid Curve Point Panic active NRDAX-T0139 - Legacy Sighash Quadratic CPU Blowup active

cite

https://nrdax.com/techniques/NRDAX-T0328

plain

NRDAX Registry. Technique NRDAX-T0328.

bibtex
@misc{nrdax_NRDAX_T0328,
  title = {Unbounded Request Body Memory Exhaustion (NRDAX-T0328)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0328},
}
json (csl)
{
  "id": "nrdax-NRDAX-T0328",
  "type": "dataset",
  "title": "Unbounded Request Body Memory Exhaustion (NRDAX-T0328)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0328",
  "publisher": "NRDAX Registry"
}