A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue. Analysed #2693786 Valid No weakness recorded – 2025-04-23 – 23 Reported Denial of Service Analysed #3241102 Valid Denial of Service – 2026-04-06 – 23 Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM Analysed #3816330 Valid Denial of Service High 2026-10-28 – 23 Remote node DOS Analysed #876530 Valid Denial of Service Medium 2026-06-29 – 24 Remote memory exhaustion in Epee RPC stack under zero Receive Window Analysed #2912194 Valid Denial of Service High 2025-04-23 – 24 Reported RPC Overflow Analysed #3240792 Valid Memory Corruption – 2026-04-06 – 25 Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks Analysed #3683886 Valid No weakness recorded Medium 2026-09-17 – 26 Hardware Wallets Do Not Check Unlock TIme Analysed #817245 Valid Cryptography Medium 2021-09-12 – 27 RPC call crashes node Analysed #1379707 Valid Denial of Service High 2022-08-20 – 28 SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash Analysed #3700036 Valid Cryptography Medium 2026-08-05 – 28 Monero Website & Kovri on your policy are returning 404 not found. Analysed #265161 Valid Input Validation and Logic None 2018-04-25 – 29 CryptoNote: remote node DoS Analysed #506595 Valid Denial of Service High 2019-07-03 – 30 ZMQ RPC Log Injection and Untrusted Payload Persistence Analysed #3621606 Valid Injection and Smuggling Medium 2026-07-24 – 30 HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer Analysed #3679471 Valid Command and Code Injection Medium 2026-08-20 – 30 Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer change Analysed #3621588 Valid Input Validation and Logic High 2026-09-16 – 32 View-only offline transaction creation bypasses the long-payment-ID privacy block Analysed #3686283 Valid Information Disclosure Medium 2026-08-20 – 32 sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset Analysed #3683934 Valid No weakness recorded High 2026-09-17 – 35 `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment Analysed #3698862 Valid Cryptography Medium 2026-08-05 – 37 Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack Analysed #3185083 Valid Information Disclosure – 2026-05-06 – 39 Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions Analysed #3601469 Valid Authentication High 2026-08-17 – 40 Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution Analysed #3619409 Valid Access Control High 2026-08-20 – 40 `check_reserve_proof` counts duplicate entries: one output can inflate `total` Analysed #3699522 Valid Input Validation and Logic Medium 2026-08-05 – 42 forum.getmonero.org Shell upload Analysed #357858 Valid Command and Code Injection High 2018-07-27 – 43 wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof) Analysed #3693636 Valid Memory Corruption High 2026-08-05 – 44 Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field Analysed #3819475 Valid No weakness recorded Medium 2026-08-20 – 44 Dynamic fee algorithm doesn't check for zero fee Analysed #1981441 Valid Denial of Service Low 2025-05-23 – 46 RPC service DOS Analysed #2338094 Valid Denial of Service Medium 2025-05-23 – 47 Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes Analysed #3738727 Valid Access Control Low 2026-07-20 – 52 Wallet RPC Restricted-Mode Policy Bypass Analysed #3620006 Valid Authentication High 2026-08-17 – 54 [Monero wallet RPC] File precreation to file ownership and credentials leak Analysed #2425873 Valid Access Control – 2024-09-04 – 75 low-level p2p ping + tcp flooding leads to a remote crash in monerod Analysed #2858802 Valid No weakness recorded Critical 2025-04-14 – 97 Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis Analysed #3307874 Valid Denial of Service Critical 2026-05-06 – 97