GHSA-h4c3-5275-vrmg: 
Rust vulnerability analysis and mitigation

A moderate severity vulnerability was identified in Nervos CKB Pool (GHSA-h4c3-5275-vrmg), affecting versions prior to 0.39.2. The vulnerability was discovered and published on March 10, 2021, with the latest update on February 3, 2024. The issue affects the transaction pool statistics functionality in the Nervos CKB software (GitHub Advisory).

The vulnerability stems from a bug in the pool statistics mechanism where conflicting transactions, upon removal from the pool, are not properly subtracted from the statistics calculations. This statistical tracking error leads to inaccurate pool state management (GitHub Advisory).

The primary impact of this vulnerability is that the transaction pool eventually becomes full and begins rejecting all transactions, effectively creating a denial of service condition for new transactions. This occurs due to the improper handling of statistics for conflicting transactions (GitHub Advisory).

The vulnerability has been patched in version 0.39.2 of the software. As a temporary workaround, users can restart the CKB node to clear the corrupted statistics. For long-term resolution, users should upgrade to version 0.39.2 or later (GitHub Advisory).