CVE-2020-5303

CVE-2020-5303 is a denial-of-service vulnerability affecting Tendermint versions prior to 0.33.3, 0.32.10, and 0.31.12. The vulnerability stems from Tendermint not limiting P2P connection requests, leading to temporary memory spikes and potential Out-Of-Memory (OOM) exceptions. Additionally, a flaw in reclaiming activeIDs for removed peers can cause the activeIDs map to continuously grow, ultimately leading to a node panic. This vulnerability has a CVSS score of 3.7 (LOW), indicating a network attack vector with high attack complexity, resulting in low availability impact. An attacker can exploit this by initiating numerous connection attempts, exhausting memory resources and causing the affected Tendermint node to crash. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.