go-ethereum Denial-of-Service Vulnerability via Malicious P2P Message

A denial-of-service vulnerability has been identified in go-ethereum (geth) versions through 1.16.7. Affected nodes can be forced to shut down or crash by sending a specially crafted message. This issue has been addressed in version 1.16.8.

Impact

Exploitation of this vulnerability leads to a forced shutdown or crash of the affected node.

Reproduction

The vulnerability can be reproduced by sending a maliciously crafted P2P message to a node running an affected version of go-ethereum. The node will then shut down or crash in response to the message.

Remediation

Users can upgrade to go-ethereum version 1.16.8 or later to address this vulnerability.