---
title: "GHSA-84x2-2qv6-qg56: Nervos CKB P2P DoS Attacks"
url: https://erroneo.us/security/ghsa/GHSA-84x2-2qv6-qg56/
description: "GHSA-84x2-2qv6-qg56 (critical, crates.io (Rust)): Nervos CKB P2P DoS Attacks. The P2P protocols lack of rate limit. For example, in relay protocol, when a…"
type: advisory
section: "Security Digest"
date_published: 2024-02-02
date_modified: 2024-02-02
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-84x2-2qv6-qg56"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-84x2-2qv6-qg56: Nervos CKB P2P DoS Attacks

## Affected packages

- crates.io (Rust) `ckb` < 0.34.0 → fixed: 0.34.0

## Details

The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests. code → . It is easy to establish a DoS attach by generating random tx hashes. Impact It affects all nodes connected to the P2P network. Workarounds Apply rate limit on the data sent to CKB P2P port.

## Sources

- [GitHub Advisory GHSA-84x2-2qv6-qg56](https://github.com/advisories/GHSA-84x2-2qv6-qg56)
- [github.com](https://github.com/nervosnetwork/ckb/security/advisories/GHSA-84x2-2qv6-qg56)
- [github.com](https://github.com/nervosnetwork/ckb/commit/c5eb5478b635cea2ccef8676cf97692cd38293c3)

---
Source page: https://erroneo.us/security/ghsa/GHSA-84x2-2qv6-qg56/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt