🎯 New Report #3683886: Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks
🔺Severity: Medium
👽 Reporter: helping bro
⭐️ Reputation: 372
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-19
⏰ Disclosed: 2026-09-17 17:42:05
📝 Summary: The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.
📂 Report JSON File: 3683886
@hackeronereports