How severe is CVE-2020-5303?

CVE-2020-5303 has a CVSS score of 3.7/10, rated LOW. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2020-5303?

CVE-2020-5303 affects the following packages: github.com/tendermint/tendermint (Go), github.com/tendermint/tendermint (Go), github.com/tendermint/tendermint (Go). Ecosystems affected: Go.

How do I fix CVE-2020-5303?

Update github.com/tendermint/tendermint to 0.33.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-5303 is resolved across your whole dependency graph.

How do I detect CVE-2020-5303 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/tendermint/tendermint, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2020-5303 if there is no patch (or I can't update yet)?

Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Is CVE-2020-5303 actively exploited in the wild?

No public exploit code has been indexed for CVE-2020-5303 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2020-5303?

CVE-2020-5303 has an EPSS (Exploit Prediction Scoring System) score of 1.4%, placing it in the 72th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2020-5303?

CVE-2020-5303 is classified as CWE-789 (CWE-789), Out-of-bounds Write (CWE-787). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2020-5303 published, and has it been updated?

CVE-2020-5303 was published on April 10, 2020 and was last updated on October 20, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

LOW severity

CVE-2020-5303 — tendermint

LOWFix: tendermint/tendermint@e2d6859

CVE-2020-5303 is a low-severity (CVSS 3.7) CWE-789 vulnerability in github.com/tendermint/tendermint. A fix is available for github.com/tendermint/tendermint — see the affected versions and patch details below.

Denial of service in Tendermint

Also known asGHSA-v24h-pjjv-mcp6

Published

Apr 10, 2020

Updated

Oct 20, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

1.4%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs72th percentile — riskier than 72% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected

🐹github.com/tendermint/tendermint🐹github.com/tendermint/tendermint🐹github.com/tendermint/tendermint

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Denial of Service 1

Tendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions.

Tendermint 0.33.3 (and 0.32.10) limits the total number of P2P incoming connection requests to to p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids).

Notes:

Tendermint does not rate limit P2P connection requests per IP (an attacker can saturate all the inbound slots);
Tendermint does not rate limit HTTP(S) requests. If you expose any RPC endpoints to the public, please make sure to put in place some protection (https://www.nginx.com/blog/rate-limiting-nginx/). We may implement this in the future (https://github.com/tendermint/tendermint/issues/1696).

Denial of Service 2

Tendermint 0.33.2 and earlier does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting Denial of Service 1), which ultimately will lead to the node panicking.

Tendermint 0.33.3 (and 0.32.10) claims activeID for a peer in InitPeer, which is executed before MConnection is started.

Notes:

InitPeer function was added to all reactors to combat a similar issue - https://github.com/tendermint/tendermint/issues/3338;
Denial of Service 2 is independent of Denial of Service 1 and can be executed without it.

Specific Go Packages Affected

github.com/tendermint/tendermint/p2p

Impact

All full nodes (except for validators who are behind closed networks)
Node's memory usage increases, then it panics either in the mempool or due to OOM.

Patches

v0.33.3
v0.32.10
v0.31.12

Workarounds

No workarounds.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in tendermint/tendermint
Email us at [email protected]

More information can be found here.

Credits

fudongbai for discovering and reporting Denial of Service 2
Ethan Buchman (@ebuchman) for writing a test case for Denial of Service 2 and Tess Rinearson (@tessr) for fixing it
Anton Kaliaev (@melekes) for fixing Denial of Service 1

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/tendermint/tendermint`	≥ 0.33.0&&< 0.33.3	0.33.3`go get github.com/tendermint/tendermint@v0.33.3`
🐹Go	`github.com/tendermint/tendermint`	all versions	0.31.12`go get github.com/tendermint/tendermint@v0.31.12`
🐹Go	`github.com/tendermint/tendermint`	≥ 0.32.0&&< 0.32.10	0.32.10`go get github.com/tendermint/tendermint@v0.32.10`

Affected Products

1 product · 3 configurations

Application

tenderminttendermint

≥ 0.33.0 && < 0.33.3

range

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/tendermint/tendermint, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/tendermint/tendermint to 0.33.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-5303 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Description **Denial of Service 1** Tendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Tendermint 0.33.3 (and 0.32.10) limits the total number of P2P incoming connection requests to to `p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids)`. Notes: - Tendermint does not rate li