Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis Analysed #3307874 Valid Denial of Service Critical 2026-05-06 – 97 low-level p2p ping + tcp flooding leads to a remote crash in monerod Analysed #2858802 Valid No weakness recorded Critical 2025-04-14 – 97 RPC service DOS Analysed #2338094 Valid Denial of Service Medium 2025-05-23 – 47 forum.getmonero.org Shell upload Analysed #357858 Valid Command and Code Injection High 2018-07-27 – 43 Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions Analysed #3601469 Valid Authentication High 2026-08-17 – 40 Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack Analysed #3185083 Valid Information Disclosure – 2026-05-06 – 39 HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer Analysed #3679471 Valid Command and Code Injection Medium 2026-08-20 – 30 ZMQ RPC Log Injection and Untrusted Payload Persistence Analysed #3621606 Valid Injection and Smuggling Medium 2026-07-24 – 30 CryptoNote: remote node DoS Analysed #506595 Valid Denial of Service High 2019-07-03 – 30 Monero Website & Kovri on your policy are returning 404 not found. Analysed #265161 Valid Input Validation and Logic None 2018-04-25 – 29 RPC call crashes node Analysed #1379707 Valid Denial of Service High 2022-08-20 – 28 Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks Analysed #3683886 Valid No weakness recorded Medium 2026-09-17 – 26 Remote memory exhaustion in Epee RPC stack under zero Receive Window Analysed #2912194 Valid Denial of Service High 2025-04-23 – 24 Remote node DOS Analysed #876530 Valid Denial of Service Medium 2026-06-29 – 24 Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM Analysed #3816330 Valid Denial of Service High 2026-10-28 – 23 A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue. Analysed #2693786 Valid No weakness recorded – 2025-04-23 – 23 Transactions in invalid blocks are kept in tx-pool without undergoing certain checks. Analysed #2315026 Valid No weakness recorded – 2025-04-23 – 23 Unix time unlock_time values have dangerous validation rules enabling a number of exploits Analysed #854726 Valid Input Validation and Logic High 2021-09-12 – 20 Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubs Analysed #379049 Valid Input Validation and Logic High 2018-07-27 – 17 Reentrancy attack in eth-monero atomic swap Analysed #1668258 Valid Access Control – 2023-04-20 – 15 Kovri: potential buffer over-read in garlic clove handling + I2NP message creation Analysed #291489 Valid Information Disclosure High 2017-12-05 – 14