GHSA-9mfc-chwf-7whf
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
Impact
When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles.
Patches
In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.
In 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.
What each source reports
GitHub AdvisoriesNo score
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
Impact
When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles.
Patches
In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.
In 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.
- Record
GHSA-9mfc-chwf-7whf- Updated
- 2026-11-02
OSVNo score
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
Impact
When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles.
Patches
In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.
In 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.
- Record
GHSA-9mfc-chwf-7whf- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckbcrates.io | before 0.43.3 | 0.43.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9mfc-chwf-7whf is a vulnerability with no CVSS score yet in ckb, published November 2, 2022. No source lists public exploit code. Fixed in ckb 0.43.3.