Read the docs
TI-2020-04359 Aliases CVE-2020-5303GHSA-v24h-pjjv-mcp6

Denial of service in Tendermint

Priority LOW 20CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests. For each p2p connection, it allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tendermint does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting above denial of service), which ultimately will lead to the node panicking. These issues are patched in Tendermint 0.33.3 and 0.32.10.

Why it matters now

EPSS 0.01369 72nd percentileScored 2026-11-07
Fix Fixed Tendermint (Tendermint): 0.32.10, 0.33.3, 0.31.12github.com/tendermint/tendermint (Go): 0.33.3, 0.31.12, 0.32.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tendermintTendermint0.32.0 to before 0.32.10; 0.33.0 to before 0.33.3; before 0.31.120.32.10, 0.33.3, 0.31.12Patch availableCNA
—github.com/tendermint/tendermint (Go)0.33.0 to before 0.33.30.33.3Patch availableGHSA-v24h-pjjv-mcp6
—github.com/tendermint/tendermint (Go)before 0.31.120.31.12Patch availableGHSA-v24h-pjjv-mcp6
—github.com/tendermint/tendermint (Go)0.32.0 to before 0.32.100.32.10Patch availableGHSA-v24h-pjjv-mcp6
  • Tendermint Vendortendermint Affected 0.32.0 to before 0.32.10; 0.33.0 to before 0.33.3; before 0.31.12 Fixed in 0.32.10, 0.33.3, 0.31.12 Patch available CNA
  • github.com/tendermint/tendermint (Go) Vendor— Affected 0.33.0 to before 0.33.3 Fixed in 0.33.3 Patch available GHSA-v24h-pjjv-mcp6
  • github.com/tendermint/tendermint (Go) Vendor— Affected before 0.31.12 Fixed in 0.31.12 Patch available GHSA-v24h-pjjv-mcp6
  • github.com/tendermint/tendermint (Go) Vendor— Affected 0.32.0 to before 0.32.10 Fixed in 0.32.10 Patch available GHSA-v24h-pjjv-mcp6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tendermint:tendermint:*:*:*:*:*:*:*:*before 0.31.12; 0.32.0 to before 0.32.10; 0.33.0 to before 0.33.3Vulnerabletendermint
  • cpe:2.3:a:tendermint:tendermint:*:*:*:*:*:*:*:* Versions before 0.31.12; 0.32.0 to before 0.32.10; 0.33.0 to before 0.33.3 Vulnerable ·tendermint

Remediation

  • Fix · CNA Tendermint (Tendermint) Fixed in 0.32.10, 0.33.3, 0.31.12
  • Fix · GHSA-v24h-pjjv-mcp6 github.com/tendermint/tendermint (Go) Fixed in 0.33.3 Advisory →
  • Fix · GHSA-v24h-pjjv-mcp6 github.com/tendermint/tendermint (Go) Fixed in 0.31.12 Advisory →
  • Fix · GHSA-v24h-pjjv-mcp6 github.com/tendermint/tendermint (Go) Fixed in 0.32.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5303
  2. 2026-10-03 Alias added: GHSA-v24h-pjjv-mcp6

References

Patch 1

Advisory 3

Other 4

  • TI-2019-15212 Uncontrolled resource consumption in github.com/tendermint/tendermint CVSS 3.1HIGH 7.5
  • TI-2021-04371 Denial of service in TenderMint Core CVSS 3.1MEDIUM 6.5
  • TI-2020-11866 Denial of Service in TenderMint CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences