Namada-apps can Crash with Excessive Computation in Mempool Validation

published 2025-02-20 last yr. modified 2025-02-20 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

A malicious transaction may cause a crash in mempool validation.

A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the node to panic.

### Patches

This issue has been patched in apps version 1.1.0. The mempool validation has been fixed to avoid overflow.

### Workarounds

There are no workarounds and users are advised to upgrade.

Patch / fix

fixed in 1

crates.io namada-apps 1.1.0

Is GHSA-82vg-5v4f-f9wq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	namada-apps	>=1.0.0, <1.1.0	1.1.0

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

GitHub Advisory GHSA-82vg-5v4f-f9wq

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.