CVE-2021-21369 – Potential DoS in Besu HTTP JSON-RPC API

https://notcve.org/view.php?id=CVE-2021-21369

09 Mar 2021 — Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requ... • https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 • CWE-400: Uncontrolled Resource Consumption •