CVE-2025-70957 Details
Description
A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling of external arguments passed to locally executed "get methods." An attacker can inject a constructed Continuation object (an internal TVM type) that is normally restricted within the VM. When the TVM executes this malicious continuation, it consumes excessive CPU resources while accruing disproportionately low virtual gas costs. This "free" computation allows an attacker to monopolize the Lite Server's processing power, significantly reducing its throughput and causing a denial of service for legitimate users acting through the gateway.
A denial-of-service vulnerability exists in TON Lite Server versions prior to 2024.10. The issue stems from how external arguments are handled in locally executed 'get methods.' An attacker can inject a specially crafted Continuation object, which is typically restricted within the virtual machine (VM). When this malicious continuation is executed, it causes excessive CPU usage while incurring minimal virtual gas costs. This imbalance allows the attacker to monopolize the server's processing power, significantly degrading performance and availability for legitimate users.
The vulnerability has been fixed in TON Lite Server version 2024.10. Users should update to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 13, 2026CISA-ADP
Assessed Feb 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Lucian-code233/d2589ece39914195c0e307b4dee32185 | [email protected] | AdvisoryRemedy |
| https://github.com/ton-blockchain/ton/commit/e35b34de22109596a54d1357dcce92d63002ba95 | [email protected] | Source CodeVendor |
| https://mp.weixin.qq.com/s/KT4RKNey_mjU2kBWpGTjuw | [email protected] | Content WallTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| TON Lite Server | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 18, 2026 | CVE Modified | CISA-ADP |
| Feb 13, 2026 | New CVE Received | [email protected] |