mx-chain-go does not treat invalid transaction with wrong username correctly
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| multiversx | mx-chain-go | before 1.4.16 | 1.4.16 | Patch available | CNA |
| — | github.com/multiversx/mx-chain-go (Go) | before 1.4.16 | 1.4.16 | Patch available | GHSA-7xpv-4pm9-xch2 |
- mx-chain-go Vendormultiversx Affected before 1.4.16 Fixed in 1.4.16 Patch available CNA
- github.com/multiversx/mx-chain-go (Go) Vendor— Affected before 1.4.16 Fixed in 1.4.16 Patch available GHSA-7xpv-4pm9-xch2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:multiversx:mx-chain-go:*:*:*:*:*:go:*:* | before 1.4.16 | Vulnerable | multiversx |
- cpe:2.3:a:multiversx:mx-chain-go:*:*:*:*:*:go:*:* Versions before 1.4.16 Vulnerable ·multiversx
Remediation
- Fix · CNA mx-chain-go (multiversx) Fixed in 1.4.16
- Fix · GHSA-7xpv-4pm9-xch2 github.com/multiversx/mx-chain-go (Go) Fixed in 1.4.16 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-33964
- 2026-10-03 Alias added: GHSA-7xpv-4pm9-xch2
References
More multiversx Mx-chain-go vulnerabilities
- TI-2023-17283 mx-chain-go's relayed transactions always increment nonce CVSS 3.1HIGH 7.1
Sources
- CVE-2023-33964 · CVE Program
- CVE-2023-33964 · NVD
- FIRST EPSS
- GHSA-7xpv-4pm9-xch2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences