{"id":"GHSA-9mfc-chwf-7whf","aliases":[],"status":"published","title":"ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.","description":"### Impact\n\nWhen a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. \n\n### Patches\n\nIn 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.\n\nIn 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-11-02T18:14:01Z","modified":"2023-01-08T05:03:22Z","fixes":[{"ecosystem":"crates.io","package":"ckb","fixed_in":["0.43.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ckb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ckb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.43.3"}]}]}],"references":[{"url":"https://github.com/nervosnetwork/ckb/security/advisories/GHSA-9mfc-chwf-7whf","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9mfc-chwf-7whf"},{"url":"https://github.com/nervosnetwork/ckb","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-9mfc-chwf-7whf","title":"ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.","description":"### Impact\n\nWhen a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. \n\n### Patches\n\nIn 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.\n\nIn 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.\n","status":"published","published":"2022-11-02T18:14:01Z","modified":"2023-01-08T05:03:22Z","updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-9mfc-chwf-7whf","title":"ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.","description":"### Impact\n\nWhen a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. \n\n### Patches\n\nIn 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.\n\nIn 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.\n","status":"published","published":"2022-11-02T18:14:01Z","modified":"2022-11-02T18:14:01Z","updated_at":"2026-11-02T15:46:43.875515Z"}]}}