What’s Vulnerable › Vulnerabilities

CVE-2024-23688: Consensys Discovery Nonce Reuse

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-19 · updated 2026-07-14
• Weakness: CWE-323

Description

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.

Affected products

• Consensys Discovery: before 0.4.5 — fixed in 0.4.5

How to fix

Upgrade to a fixed version: Consensys Discovery 0.4.5. Check the vendor advisory for mitigations.

References

• https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g
• https://github.com/advisories/GHSA-w3hj-wr2q-x83g
• https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g
• https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g
• https://github.com/advisories/GHSA-w3hj-wr2q-x83g
• https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g

Get alerted when CVE-2024-23688 or the next vulnerability affects your stack