Skip to content
Fencer Vulns
high 8.2

CVE-2024-34360 json

Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX

published 2024-05-10 2 y ago modified 2026-09-10 1 mo ago also GHSA-jcqq-g64v-gcm7 , GO-2024-2831 , EUVD-2024-1663

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. This vulnerability is fixed in go-spacemesh 1.5.2-hotfix1 and Spacemesh API 1.37.1.

Patch / fix

  • go github.com/spacemeshos/go-spacemesh 1.5.2-hotfix1
  • go github.com/spacemeshos/api 1.37.1
  • go github.com/spacemeshos/api/release/go 1.37.1
  • spacemeshos go-spacemesh 1.5.2-hotfix1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/spacemeshos/go-spacemesh
<1.5.2-hotfix1
1.5.2-hotfix1
go github.com/spacemeshos/api
<1.37.1
1.37.1
go github.com/spacemeshos/api/release/go
<1.37.1
1.37.1

Affected products

  • spacemeshos go-spacemesh

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.