GHSA-3fm3-m23v-5r46HighCVSS 7.5

Tendermint Client package vulnerable to Uncontrolled Resource Consumption

Published
December 28, 2022
Last Modified
February 17, 2023

🔗 CVE IDs covered (1)

📋 Description

Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.

🎯 Affected products1

  • go/github.com/tendermint/tendermint:< 0.31.1

🔗 References (5)