CVE-2024-34360

go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. This vulnerability is fixed in go-spacemesh 1.5.2-hotfix1 and Spacemesh API 1.37.1.

• CWE-754

• https://github.com/spacemeshos/api/commit/1d5bd972bbe225d024c3e0ae5214ddb6b481716e
• https://github.com/spacemeshos/go-spacemesh/commit/9aff88d54be809ac43d60e8a8b4d65359c356b87
• https://github.com/spacemeshos/go-spacemesh/security/advisories/GHSA-jcqq-g64v-gcm7
• https://github.com/spacemeshos/api/commit/1d5bd972bbe225d024c3e0ae5214ddb6b481716e
• https://github.com/spacemeshos/go-spacemesh/commit/9aff88d54be809ac43d60e8a8b4d65359c356b87
• https://github.com/spacemeshos/go-spacemesh/security/advisories/GHSA-jcqq-g64v-gcm7

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34355TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34356TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34357TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34358TYPO3 is an enterprise content management system. Starting i…5.3
• CVE-2024-34359llama-cpp-python is the Python bindings for llama.cpp. `llam…9.6
• CVE-2024-3436A vulnerability was found in SourceCodester Prison Managemen…7.2
• CVE-2024-34361Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2024-34362Envoy is a cloud-native, open source edge and service proxy.…5.9
• CVE-2024-34363Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-34364Envoy is a cloud-native, open source edge and service proxy.…6.5
• CVE-2024-34365** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vu…9.1
• CVE-2024-34366Improper Neutralization of Input During Web Page Generation …5.9