Polygon Labs released Bor v2.10.3, fixing two moderate-severity vulnerabilities in parallel execution and stating that no exploitation has been identified
BIBIBI
AT A GLANCE
Polygon released Bor v2.10.3, fixing two moderate-severity denial-of-service vulnerabilities.
Article
Polygon released Bor v2.10.3 fixes parallel execution vulnerabilities and clarifies that no exploitation has been identified
PANews October 15 reported that Polygon Labs announced that Bor v2.10.3 version has now been officially released, fixing two moderate-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. The first vulnerability involved a shared Keccak-256 cache without a capacity limit, while the second involved repeatedly calculating smart contract code hashes during parallel execution. Officials stated that the vulnerabilities affect the V2 and Bor v2.10.1 versions with BlockSTM v2.10.2 enabled by default, and that no exploitation has currently been identified on the mainnet or the Amoy testnet.
Polygon Labs announced Bor v2.10.3 version has been officially released.
02
This version fixes two moderate-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution.
03
One vulnerability involved a shared Keccak-256 cache without a capacity limit.
04
The other vulnerability involved repeatedly calculating smart contract code hashes during parallel execution.
05
The vulnerabilities affect V2 versions with BlockSTM enabled by default, including Bor v2.10.1 and v2.10.2.
06
Officials stated that no exploitation of the vulnerabilities has currently been identified on the mainnet or the Amoy testnet.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Bor is Polygon the software version in use. This update fixes two issues that could cause service disruptions, but they have not currently been found to have been exploited on the mainnet or the Amoy testnet.
Why it matters to readers
using Bor v2.10.1 or v2.10.2 nodes may face related denial-of-service risks,v2.10.3 has provided a patched version.
This is a cybersecurity update: it identifies the affected versions and states whether officials have found evidence that the vulnerabilities were exploited.
Risks and unknowns
The evidence does not indicate whether the relevant nodes have completed the upgrade.
“No exploitation has been identified” does not mean it can be confirmed that the vulnerabilities were never exploited.
The evidence does not indicate whether service disruptions will still occur after the upgrade.
Related Developments
Loading event timeline…
Related concepts
parallel block execution
This term is not in the glossary yet. Browse related concepts in the glossary.
