CVE-2025-29072

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29072
An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314 Third Party Advisory
https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:nethermind:juno:*:*:*:*:*:*:*:*
History

11 Apr 2025, 17:20

Type Values Removed Values Added
Summary
  • (es) Un desbordamiento de enteros en Nethermind Juno anterior a la versión 12.05, dentro de la lógica de descompresión de bytecode de Sierra, dentro de la librería "cairo-lang-starknet-classes", podría permitir a atacantes remotos activar un bucle infinito (y un alto consumo de CPU) al enviar una transacción maliciosa Declare v2/v3. Esto genera una condición de denegación de servicio para las implementaciones de nodo completo de Starknet afectadas.
First Time Nethermind
Nethermind juno
CPE cpe:2.3:a:nethermind:juno:*:*:*:*:*:*:*:*
References () https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314 - () https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314 - Third Party Advisory
References () https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587 - () https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587 - Patch

28 Mar 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-190

27 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 16:15

Updated : 2025-04-11 17:20

NVD link : CVE-2025-29072

Mitre link : CVE-2025-29072

CVE.ORG link : CVE-2025-29072

JSON object : View

Products Affected

nethermind

  • juno
CWE
CWE-190

Integer Overflow or Wraparound