CVE-2025-70957: TON Lite Server DoS Vulnerability

CVE-2025-70957 Overview

A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling of external arguments passed to locally executed "get methods." An attacker can inject a constructed Continuation object (an internal TVM type) that is normally restricted within the VM. When the TVM executes this malicious continuation, it consumes excessive CPU resources while accruing disproportionately low virtual gas costs. This "free" computation allows an attacker to monopolize the Lite Server's processing power, significantly reducing its throughput and causing a denial of service for legitimate users acting through the gateway.

Critical Impact

Attackers can exhaust server CPU resources through crafted Continuation objects, causing service degradation and denial of service for legitimate TON blockchain users.

Affected Products

• TON Lite Server versions prior to v2024.09
• TON Blockchain infrastructure using vulnerable Lite Server instances
• Gateway services relying on TON Lite Server for blockchain access

Discovery Timeline

• 2026-02-13 - CVE CVE-2025-70957 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-70957

Vulnerability Analysis

This vulnerability (CWE-674: Uncontrolled Recursion) exists in the TON Virtual Machine's (TVM) handling of external arguments passed to locally executed "get methods." The core issue stems from improper validation of input types, allowing attackers to inject Continuation objects that are normally restricted internal TVM types.

When the TVM processes these malicious Continuation objects, a critical disconnect occurs between actual CPU consumption and the virtual gas metering system. The injected continuations trigger computation-intensive operations that bypass the gas cost accounting mechanism, essentially allowing "free" computation from the attacker's perspective while consuming real server resources.

Root Cause

The root cause is insufficient input validation and type checking when processing external arguments in the Lite Server's get method handler. The TVM fails to properly restrict or sanitize Continuation objects from external sources, trusting that these internal types would only originate from legitimate internal VM operations. This trust assumption creates an exploitable gap where malicious actors can craft and inject these restricted objects through external interfaces.

Attack Vector

The attack is conducted remotely over the network without requiring authentication or user interaction. An attacker crafts a specially constructed Continuation object and passes it as an argument to a locally executed get method on the TON Lite Server. When the server processes this request:

1. The malicious Continuation object is accepted without proper type validation
2. The TVM begins executing the continuation, triggering resource-intensive operations
3. The gas metering system fails to properly account for the actual computational cost
4. CPU resources are consumed disproportionately to the reported gas usage
5. Repeated exploitation monopolizes server processing capacity, denying service to legitimate users

The vulnerability allows attackers to amplify their impact by consuming server resources at minimal virtual cost, making it an efficient denial of service attack vector. Technical details and proof of concept information can be found in the GitHub Gist and WeChat Security Article.

Detection Methods for CVE-2025-70957

Indicators of Compromise

• Unusual CPU utilization spikes on TON Lite Server instances without corresponding increase in legitimate traffic
• Discrepancy between reported virtual gas consumption and actual server resource usage
• Repeated requests to get methods with complex or unusual argument structures
• Service degradation or timeout errors reported by legitimate gateway users

Detection Strategies

• Monitor CPU utilization on Lite Server instances and alert on sustained high usage patterns
• Implement logging for get method invocations to track argument types and request patterns
• Correlate virtual gas consumption metrics with actual CPU time to identify exploitation attempts
• Deploy network monitoring to detect high-frequency requests targeting Lite Server endpoints

Monitoring Recommendations

• Establish baseline metrics for normal Lite Server CPU and memory consumption
• Configure alerting thresholds for CPU usage anomalies that exceed normal operational patterns
• Monitor request rates and latency metrics to detect service degradation early
• Implement real-time analysis of TVM execution patterns to identify abnormal continuation processing

How to Mitigate CVE-2025-70957

Immediate Actions Required

• Upgrade TON Lite Server to version v2024.09 or later immediately
• Implement rate limiting on get method endpoints to reduce exploitation impact
• Monitor server resources closely for signs of active exploitation
• Consider implementing additional input validation at the gateway layer

Patch Information

The TON blockchain team has addressed this vulnerability in version v2024.09. The fix implements proper validation and restriction of Continuation objects from external sources. The specific commit addressing this issue is available in the GitHub Commit Details. Organizations should prioritize upgrading to the patched version as the primary remediation strategy.

Workarounds

• Implement strict rate limiting on Lite Server endpoints to reduce the impact of exploitation attempts
• Deploy a reverse proxy or WAF to filter and validate incoming requests before they reach the Lite Server
• Consider running multiple Lite Server instances behind a load balancer to distribute potential attack load
• Implement resource limits (cgroups, containers) to prevent a single Lite Server from consuming all available CPU

# Example rate limiting configuration for nginx proxy
limit_req_zone $binary_remote_addr zone=liteserver:10m rate=10r/s;

location /liteserver {
    limit_req zone=liteserver burst=20 nodelay;
    proxy_pass http://ton-lite-server:port;
}