GHSA-3WHF-VGF2-9W6G: Denial of Service via Unbounded Recursion and State Panic in zaino-state
Vulnerability ID: GHSA-3WHF-VGF2-9W6G
CVSS Score: 5.1
Published: 2026-07-31
The zaino-state crate contains two critical flaws in its block reorganization and state synchronization logic. An unbounded recursive async function handling block reorganization fails to validate cyclic relationships, enabling network peers to cause infinite loops that exhaust CPU and memory resources. Furthermore, a logical pruning error during non-finalized block cache trimming can purge all cached blocks, triggering an immediate panic and crash of the daemon.
TL;DR
zaino-state is vulnerable to unconstrained recursive block reorganization and an unhandled panic during state cache pruning, causing denial of service.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-770
- Attack Vector: Network
- CVSS v4 Score: 5.1
- Impact: Denial of Service (CPU & Memory Exhaustion, Daemon Crash)
- Exploit Status: PoC Mechanics Documented
- CISA KEV Status: Not Listed
Affected Systems
- zaino-state indexer nodes
-
zaino-state: >= 0.0.0, < 0.4.1 (Fixed in:
0.4.1)
Code Analysis
Commit: 4288225
Add bound to reorg loop to mitigate infinite async recursion.
Commit: d874295
Prevent empty Non-Finalized State snapshots during pruning to avoid expect panics.
Commit: e05112a
Changelog and version bump to 0.4.1.
Exploit Details
- GitHub Advisory: Advisory documenting the cyclic block construction vector and memory consumption mechanisms.
Mitigation Strategies
- Upgrade to zaino-state v0.4.1 or higher.
- Restrict validator peer connections to trusted hosts to block malicious header delivery.
- Configure system-level resource constraints (CPU quotas) on the indexer processes.
Remediation Steps:
- Identify and update Cargo.toml dependencies to set the 'zaino-state' package to version '^0.4.1'.
- Execute 'cargo update -p zaino-state' to sync your lockfile with the patched release.
- Deploy the updated indexer binary to production systems using a restart supervisor (e.g. systemd or supervisord) configured to auto-restart upon unexpected termination.
References
Read the full report for GHSA-3WHF-VGF2-9W6G on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)