CVE-2024-32972: Go-Ethereum (Geth) DoS Vulnerability

CVE-2024-32972 Overview

CVE-2024-32972 is a denial-of-service vulnerability in go-ethereum (geth), the Go implementation of the Ethereum execution layer protocol. A vulnerable node consumes excessive memory when processing specially crafted peer-to-peer (p2p) messages sent from an attacker-controlled node. The flaw affects all geth releases prior to 1.13.15 and is categorized as Uncontrolled Resource Consumption [CWE-400]. Exploitation requires only network reachability to a target node, making any internet-facing geth instance a viable target. The Ethereum project resolved the issue in geth 1.13.15.

Critical Impact
An unauthenticated remote attacker can exhaust memory on a target geth node, causing process termination and disrupting Ethereum network participation.

Affected Products

go-ethereum (geth) versions prior to 1.13.15
Ethereum execution layer clients built on affected geth releases
Downstream forks and node operators tracking the v1.13.x branch before 1.13.15

Discovery Timeline

2024-05-06 - CVE-2024-32972 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32972

Vulnerability Analysis

The vulnerability resides in geth's handling of inbound p2p protocol messages exchanged between Ethereum nodes. An attacker peer can transmit a specially crafted message that triggers allocation of very large memory buffers on the receiving node. The receiving process has no effective upper bound on the memory committed while parsing or buffering the attacker-supplied input. Sustained or repeated delivery of such messages drives the node into out-of-memory conditions, terminating the geth process and removing the validator or RPC endpoint from service. The bug maps to [CWE-400] Uncontrolled Resource Consumption and impacts availability only; confidentiality and integrity of chain data are not affected.

Root Cause

The defect stems from insufficient validation of size or count fields in attacker-controlled p2p message structures before memory allocation occurs. The decoding path trusts attacker-supplied length hints and reserves buffers proportional to them. Without a bounded ceiling, a single malformed message can request gigabytes of memory. The fix in geth 1.13.15 introduces stricter input validation and bounded allocation during p2p message decoding. See the GitHub Security Advisory GHSA-4xc9-8hmq-j652 for the official advisory and the version diff between v1.13.14 and v1.13.15 for the code-level changes.

Attack Vector

Exploitation occurs over the Ethereum devp2p network protocol. An attacker only needs to establish a peer connection to the victim node, which is the normal operating mode of a public Ethereum client. No authentication, user interaction, or prior privilege is required. The attacker then transmits the crafted p2p frame, and the victim allocates excessive memory while attempting to process it. The vulnerability mechanism is described in the upstream advisory; no public proof-of-concept exploit code is referenced in the CVE record.

Detection Methods for CVE-2024-32972

Indicators of Compromise

Sudden, sustained spikes in resident memory (RSS) of the geth process without a corresponding workload change
Out-of-memory (OOM) kills of geth in kernel logs (dmesg, journalctl) on otherwise stable hosts
Repeated geth restarts correlated with inbound peer connections from unfamiliar enode IDs
Abnormal growth in p2p message queue metrics exposed by geth's --metrics endpoint

Detection Strategies

Monitor geth process memory utilization and alert on rapid growth toward host limits or cgroup ceilings
Compare the running geth version against 1.13.15 across all node inventory and flag any host below that baseline
Capture and review devp2p peer connection logs for short-lived peers preceding memory spikes or crashes

Monitoring Recommendations

Export geth Prometheus metrics and track p2p/ingress, p2p/egress, and Go runtime memory counters
Configure host-level alerts for OOM-killer events targeting blockchain client processes
Track peer churn and disconnect reasons to surface anomalous peers attempting protocol abuse

How to Mitigate CVE-2024-32972

Immediate Actions Required

Upgrade all go-ethereum deployments to version 1.13.15 or later without delay
Inventory every host running geth and confirm the binary version using geth version
Restart upgraded nodes and verify peering and sync state return to normal after the upgrade

Patch Information

The Ethereum maintainers released the fix in go-ethereum 1.13.15. Operators should pull the patched release from the official go-ethereum repository and review the GHSA-4xc9-8hmq-j652 advisory for full remediation guidance. No backported fix for earlier minor branches is listed in the advisory, so upgrading to 1.13.15 or newer is required.

Workarounds

Restrict inbound p2p connectivity using firewall rules and limit --maxpeers to trusted, known peers where operationally feasible
Run geth under cgroup or systemd memory limits to contain OOM impact and accelerate process restart
Deploy redundant geth nodes behind a load balancer so that a single node crash does not break RPC availability

bash

# Configuration example: verify version and enforce a memory ceiling via systemd
geth version

# /etc/systemd/system/geth.service.d/override.conf
[Service]
MemoryMax=8G
Restart=always
RestartSec=5