NullRabbit

A BGP route leak at one hosting provider pushed 30 Solana validators out of consensus on 12 August 2026. The network held. Resolving every affected address against the regional registries turned up something more durable than the incident: 22.21% of all S

Zebra's getaddressutxos RPC returns all UTXOs for a transparent address without pagination, allowing an attacker to amplify a 116 B request into a 236 KB response (2,033) by seeding an address with dust UTXOs.

Zebra's getaddresstxids RPC returns every transaction identifier for a queried transparent address without pagination, allowing a 116-byte request to trigger a response that scales with the number of transactions at the address, measured at 578 amplificat

Walrus storage-node's HTTP/2 server ships with http2_max_pending_accept_reset_streams = u32::MAX, disabling the post-CVE-2023-44487 accounting limit. An unauthenticated attacker forces rapid stream resets, accumulating unbounded pending-accept-reset state

A pre-auth HTTP/2 stream flood on the rusty-kaspa gRPC P2P endpoint causes inbound-peering exhaustion via eviction and admission denial.

A single unauthenticated eth_simulateV1 call with a gap between two block numbers makes go-ethereum synthesise up to 256 full block headers, expanding a 285-byte request into a 434 KB response.

A single unauthenticated eth_call invoking the BLAKE2F precompile with a caller-set rounds field pins a go-ethereum RPC worker's CPU for hundreds of milliseconds from a sub-kilobyte request.

An unauthenticated peer can force a Casper node to run a full P-521 ECDSA signature verification during TLS-1.3 handshake - before any admission gate, allowlist, or per-peer cap - burning crypto-CPU via fresh-cert-per-connection churn.

Walrus storage-node's HTTP/2 server ships with http2_max_pending_accept_reset_streams = u32::MAX, disabling the post-CVE-2023-44487 accounting limit. An unauthenticated attacker forces rapid stream resets, accumulating unbounded pending-accept-reset state

A pre-auth HTTP/2 stream flood on the rusty-kaspa gRPC P2P endpoint causes inbound-peering exhaustion via eviction and admission denial.