🔺Severity: Medium
👽 Reporter: helping bro
⭐️ Reputation: 372
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-18
⏰ Disclosed: 2026-09-17 17:38:21
📝 Summary: The ZMQ
get output distribution RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded amounts array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount 0. The issue was also reachable with --restricted-zmq-rpc because ZMQ lacked the stricter validation applied by restricted HTTP RPC. The vulnerability was resolved in https://github.com/monero-project/monero/pull/10419 and v0.18.5.0.📂 Report JSON File: 3681690
@hackeronereports