PT-2026-8040 · Unknown · Ton Lite Server

Published 2026-02-13 · Updated 2026-02-18 · CVE-2025-70957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TON Lite Server versions prior to 2024.09

Description A Denial of Service (DoS) issue exists in the handling of external arguments passed to “get methods” in the TON Lite Server. An attacker can inject a crafted Continuation object, normally restricted within the Virtual Machine (VM), to consume excessive CPU resources with minimal virtual gas costs. This allows monopolization of the Lite Server’s processing power, leading to a denial of service for legitimate users. The vulnerability impacts the server’s throughput.

Recommendations Update to version 2024.09 or later.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-70957

Affected Products

Ton Lite Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-70957 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70957 · Vendor Advisory
• https://github.com/ton-blockchain/ton/commit/e35b34de22109596a54d1357dcce92d63002ba95 · Note
• https://mp.weixin.qq.com/s/KT4RKNey_mjU2kBWpGTjuw · Note
• https://t.me/CVEtracker/44668 · Telegram Post
• https://t.me/cveNotify/152334 · Telegram Post
• https://twitter.com/CVEnew/status/2022437753711931496 · Twitter Post
• https://gist.github.com/Lucian-code233/d2589ece39914195c0e307b4dee32185 · Note