Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nethermindeth/nethermind
master @ 37e2a0b
186
Fixes
1
CVEs
CRITICAL
Peak severity
13.5%
Coverage
Highlights
Denial of Service: 139 prior fixes. Scrutinize any change in this area.
Nethermind.Network: most-fixed (12 issues). Treat as high-risk during review.
108 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Recursive decoding of untrusted peer-to-peer data and missing length validation on raw decoded values historically led to severe out-of-bounds memory reads and allocation-based node crashes. Robust limits must be placed on decoded array sizes and prefix lengths.
Auth Bypass: Failing to enforce protocol-level validations such as transaction type checks, chain ID validation, and sender validation can allow invalid or unauthorized transactions to bypass validation rules and enter the block template or tx pool.
Denial of Service: The JSON-RPC interface has suffered from several memory exhaustion and stack overflow vectors, including unrestricted array sizes in filter inputs, unbounded trace call parameters, and recursive calls during deep frame serialization.