Monero · Report #3816330
Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
Validstatus
highseverity
23upvotes
28 Oct 2026disclosed
Summary
Monero's IPv6 connection tracking uses individual /128 addresses, allowing the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermines the intended connection restrictions for IPv6 clients.
Resolved in v0.18.5.3: https://github.com/monero-project/monero/pull/10812
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.