GHSA-xc79-566c-j4qx Parallax is vulnerable to DoS via malicious p2p message
An attacker can cause a Parallax node to consume excessive memory and crash by sending a crafted peer-to-peer message exploiting an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xc79-566c-j4qx?
GHSA-xc79-566c-j4qx is a vulnerability in github.com/microstack-tech/parallax, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.
In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message with a count of 0, using the Parallax protocol.
In descendants := chain.GetHeadersFrom(num+count-1, count-1), the value of count-1 is passed to the function GetHeadersFrom(number, count uint64) as parameter count. Due to integer overflow, UINT64_MAX value is then passed as the count argument to function GetHeadersFrom(number, count uint64). This allows an attacker to bypass maxHeadersServe and request all headers from the latest block back to the genesis block.
Patches
The fix has been included in the Parallax client version 0.1.4 and onwards.
The vulnerability was patched in: https://github.com/microstack-tech/parallax/commit/f759e9090aaf00a43c616d7cbd133c44bb1ed01e
Workarounds
No workarounds have been made public.
Credit
This issue was disclosed responsibly by DongHan Kim via the Ethereum bug bounty program, the cooperation is appreciated.
Which versions are affected by GHSA-xc79-566c-j4qx?
3 open source packages ship an affected version, including github.com/microstack-tech/parallax.
| Package | Affected | Fixed in |
|---|---|---|
github.com/microstack-tech/parallax Go | All versions | 0.1.4 |
github.com/microstack-tech/parallax Go | All versions | 0.1.4 |
github.com/microstack-tech/parallax Go | All versions | 0.1.4 |
How do I fix GHSA-xc79-566c-j4qx?
Upgrade github.com/microstack-tech/parallax to 0.1.4 or later.
Is GHSA-xc79-566c-j4qx being exploited?
There is no known exploitation of GHSA-xc79-566c-j4qx in the wild and no public exploit code.
Sources
Also known as GO-2025-4019.