GHSA-h4c3-5275-vrmg
Nervos CKB Pool does not remove the conflicting transactions from the statistics
Impact
There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions.
Patches
0.39.2
Workarounds
Restart the CKB node.
What each source reports
GitHub AdvisoriesNo score
Nervos CKB Pool does not remove the conflicting transactions from the statistics
Impact
There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions.
Patches
0.39.2
Workarounds
Restart the CKB node.
- Record
GHSA-h4c3-5275-vrmg- Updated
- 2026-11-02
OSVNo score
Nervos CKB Pool does not remove the conflicting transactions from the statistics
Impact
There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions.
Patches
0.39.2
Workarounds
Restart the CKB node.
- Record
GHSA-h4c3-5275-vrmg- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckbcrates.io | before 0.39.2 | 0.39.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h4c3-5275-vrmg is a vulnerability with no CVSS score yet in ckb, published February 3, 2024. No source lists public exploit code. Fixed in ckb 0.39.2.