security: fixes p2p memory DoS via crafted response messages (CVE-2026-26313)

[chris-mercer]

Security: Pre-decode item count validation for eth and snap protocols (CVE-2026-26313)

A malicious peer can send a p2p response (BlockHeaders, BlockBodies, Receipts, PooledTransactions, Transactions) with a valid RLP list header claiming millions of tiny items. The existing 10 MiB maxMessageSize byte-size check passes, but msg.Decode allocates pointer/struct objects proportional to item count via reflection before the response is validated — 10 MiB of 1-byte RLP items (~10M items) causes OOM.

How it works

Before msg.Decode runs, the raw message payload (already buffered in memory by the transport layer) is scanned using rlp.CountValues — a zero-allocation operation that reads only RLP tag bytes. If the item count exceeds the protocol limit, the message is rejected immediately with a disconnect.

For request-ID wrapped responses ([requestId, [items...]]), the validation skips the RequestId field and counts the inner list. For flat broadcasts like TransactionsMsg and NewBlockHashesMsg, the outer list items are counted directly.

Changes

• eth/protocols/eth/msgvalidate.go: Pre-decode item count validation for eth protocol messages
• eth/protocols/eth/handler.go: Wire validation into handleMessage between size check and handler dispatch
• eth/protocols/snap/msgvalidate.go: Pre-decode item count validation for snap protocol messages
• eth/protocols/snap/handler.go: Wire validation into HandleMessage between size check and message switch

Validated messages

eth protocol:

• BlockHeadersMsg, BlockBodiesMsg, ReceiptsMsg, PooledTransactionsMsg — limit: 2048 (2x serve-side maxHeadersServe/maxBodiesServe)
• TransactionsMsg — limit: 32768 (matches maxKnownTxs)
• NewBlockHashesMsg — limit: 2048

snap protocol:

• AccountRangeMsg, StorageRangesMsg, ByteCodesMsg, TrieNodesMsg — limit: 2048 (2x serve-side maxCodeLookups/maxTrieNodeLookups)

Vulnerability

ID	Severity	Description
CVE-2026-26313	High	DoS via crafted p2p message — attacker causes OOM through response messages with millions of tiny items

Approach: Minimal port

The full upstream fix (go-ethereum PR #33835) is a 26-file, 1,100+ line refactor that restructures BlockBody fields to rlp.RawList[T], introduces generic ReceiptsPacket[L] types, refactors p2p/tracker from global to per-peer, and changes DeliverBodies signatures. Cherry-picking produces 13 merge conflicts including 2 modify/delete (core-geth deleted receipt.go which upstream modified), making a clean backport infeasible.

This minimal port addresses the core vulnerability — OOM from crafted responses — with ~120 lines of validation code and zero structural changes. It uses only rlp.Split and rlp.CountValues which exist on the current Go 1.21 codebase.

Verification

go build ./eth/protocols/eth/... ./eth/protocols/snap/...   # ✅
go vet ./eth/protocols/eth/... ./eth/protocols/snap/...     # ✅
go test ./eth/protocols/eth/... -run TestValidateMessage -v # ✅ 10 tests
go test ./eth/protocols/snap/... -run TestValidateSnap -v   # ✅ 9 tests

References

• CVE-2026-26313 advisory
• go-ethereum fix (PR #33835) — full refactor
• Issue #692 — niooss-ledger security audit listing unfixed CVEs

---

Road to Olympia — Core-Geth Modernization March

Developed by White B0x Inc. for Ethereum Classic DAO LLC

🤖 Generated with Claude Code

Merge Order

• Dependencies: None — this PR is independent and can be merged in any order
• Part of: Core-Geth Modernization March — Wave 1 (Security)
• Completes: Coverage of all 6 CVEs identified in issue Is CoreGeth vulnerable to CVE-2025-24883, CVE-2026-22862 and CVE-2026-22868? etclabscore/core-geth#692

[Copilot]

Pull request overview

This PR mitigates CVE-2026-26313 by pre-validating RLP item counts for selected eth and snap protocol messages before msg.Decode runs, preventing reflection-driven allocation blowups from crafted “many tiny items” payloads.

Changes:

• Add pre-decode RLP list item-count validators for eth and snap response messages.
• Wire validation into eth and snap message handlers between size checks and decode/dispatch.
• Add unit tests covering below/at/above-limit, malformed RLP pass-through, and message-type coverage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
eth/protocols/eth/msgvalidate.go	Adds eth message item-count validation via rlp.Split + rlp.CountValues.
eth/protocols/eth/msgvalidate_test.go	Tests eth validation behavior and limits.
eth/protocols/eth/handler.go	Invokes eth validation prior to handler dispatch and rewinds payload.
eth/protocols/snap/msgvalidate.go	Adds snap response item-count validation on the primary list after RequestId.
eth/protocols/snap/msgvalidate_test.go	Tests snap validation behavior and limits.
eth/protocols/snap/handler.go	Invokes snap validation prior to message switch and rewinds payload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.