HexBrain

Monero · Report #3681690

ZMQ get_output_distribution duplicate amount DoS

Validstatus
mediumseverity
22upvotes
17 Sept 2026disclosed

Summary

ZMQ get_output_distribution RPC is vulnerable to memory exhaustion DoS.

The method accepts an unbounded amounts array and returns a separate distribution for each entry. Repeating amount 0 causes the daemon to duplicate the full RingCT output distribution many times, allowing a small request to expand into a very large response.

The issue is also reachable with --restricted-zmq-rpc, because ZMQ lacks the stricter validation applied by restricted HTTP RPC.

Resolved in https://github.com/monero-project/monero/pull/10419 and v0.18.5.0.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original