AIKIDO-2026-10262

TL;DR

Affected versions of this package allow malicious peers to send Txs protobuf messages containing excessive or zero-length transactions, which are not properly validated. An attacker can exploit this by flooding nodes with messages packed with thousands of empty entries, triggering repeated SHA256 hashing, memory allocations, map operations, and CheckTx calls, leading to uncontrolled CPU and memory consumption. This resource exhaustion can degrade performance or cause out-of-memory crashes, effectively resulting in a denial-of-service condition for honest nodes.