CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).

• CWE-400

• https://dl.acm.org/doi/pdf/10.1145/3460120.3485369Exploit, Mitigation, Technical Description, Third Party Advisory
• https://tristartom.github.io/docs/ccs21.pdfExploit, Mitigation, Technical Description, Third Party Advisory
• https://dl.acm.org/doi/pdf/10.1145/3460120.3485369Exploit, Mitigation, Technical Description, Third Party Advisory
• https://tristartom.github.io/docs/ccs21.pdfExploit, Mitigation, Technical Description, Third Party Advisory

Published

Mar 4, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23318A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows a…7.1
• CVE-2022-23319A segmentation fault during PCF file parsing in pcf2bdf vers…5.5
• CVE-2022-2332A local unprivileged attacker may escalate to administrator …7.8
• CVE-2022-23320XMPie uStore 12.3.7244.0 allows for administrators to genera…7.5
• CVE-2022-23321A persistent cross-site scripting (XSS) vulnerability exists…4.8
• CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allo…7.5
• CVE-2022-23329A vulnerability in ${"freemarker.template.utility.Execute"?n…9.8
• CVE-2022-2333If an attacker manages to trick a valid user into loading a …7.8
• CVE-2022-23330A remote code execution (RCE) vulnerability in HelloWorldAdd…8.8
• CVE-2022-23331In DataEase v1.6.1, an authenticated user can gain unauthori…8.8
• CVE-2022-23332Command injection vulnerability in Manual Ping Form (Web UI)…8.8
• CVE-2022-23334The Robot application in Ip-label Newtest before v8.5R0 was …9.8