Vulnerability · Published Mar 27, 2025 · Assigned by mitre
CVE-2025-29072
High 7.5
In plain English
A high-severity integer overflow in the github.com/NethermindEth/juno package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/NethermindEth/juno | 0.12.5 | GHSA-wq32-8rp4-w2mc |
| Go | github.com/NethermindEth/juno | 0.12.5 | GO-2025-3583 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H