-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0271
============================================================

Advisory-ID:  0xCERT-2026-0271
Severity:     Medium
Published:    2026-10-15T13:51:00.000Z
Updated:      2026-10-24T12:44:25.714Z
Chains:       Polygon
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0271

Title: Polygon Bor v2.10.3 fixes two BlockSTM V2 denial-of-service bugs that can stall or exhaust PoS nodes

Summary
- -------
Bor v2.10.1 and v2.10.2 (BlockSTM V2 on by default) carry two Medium DoS bugs, an unbounded keccak256 cache and repeated code hashing, that can delay block import or exhaust memory on Polygon PoS nodes. Upgrade to Bor v2.10.3; no hardfork required.

Details
- -------
Summary
Polygon Labs published Bor v2.10.3 as a security and stability release and disclosed two Medium-severity denial-of-service issues in BlockSTM V2 parallel block execution, both reported through the Immunefi bug bounty program. One is an unbounded shared keccak256 cache; the other is repeated full code-hash computation during parallel execution. Neither issue is consensus-affecting.

Affected
- - Polygon Bor v2.10.1 and v2.10.2 (BlockSTM V2 enabled by default)
- - Fixed in Bor v2.10.3 (also distributed earlier to validators as v2.10.3-priv / v2.10.3-beta-priv)

Impact
1. Unbounded shared keccak256 cache (Medium): the parallel processor and execution prefetcher shared a per-block hash cache with no size limit, which speculative execution could fill with hundreds of MiB. Polygon's test block (~9.3M gas) caused about 690 MiB of allocation and over one second of import time on a 4-core setup; repeated blocks could cause block lag and memory exhaustion on lightly provisioned nodes.
2. Repeated code hashing in parallel execution (Medium): reading the code hash of an account whose code changed earlier in the same transaction recomputed the full hash each time. One transaction against a maximum-size contract took about 11 seconds in the parallel processor versus tens of milliseconds serially, so one such transaction per block could delay import by several seconds on every BlockSTM V2 node (liveness risk).
Polygon states that, as far as it knows, neither issue was exploited on mainnet or the Amoy testnet.

Recommended actions
- - Upgrade Polygon PoS nodes to Bor v2.10.3. It is not a hardfork; nodes can be upgraded one at a time, in any order.
- - Before restarting, check [heimdall] timeout in config.toml: it is now honoured (default 30s), and older sample configs set it to 5s.

Source & attribution
This 0xCERT advisory summarises the "Bor Security Bug Fix Review (v2.10.3)" post by Polygon Labs on the Polygon forum (https://forum.polygon.technology/t/bor-security-bug-fix-review-v2-10-3/22379) and the Bor v2.10.3 release notes (https://github.com/0xPolygon/bor/releases/tag/v2.10.3). The issues were reported via Immunefi; Polygon did not name the reporters. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://forum.polygon.technology/t/bor-security-bug-fix-review-v2-10-3/22379
- - https://github.com/0xPolygon/bor/releases/tag/v2.10.3
- - https://forum.polygon.technology/t/bor-v2-10-3-release-mainnet-and-testnet-pos/22372

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroIuAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcme2XBSz0XieoeN8WgoDGRYCVs0J5qJ0HlsTeUS9
87NoAxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADy/AEA6bpZkd2tYW+c9qB8
2Bf06JwW+qUoGxjl6dw9yUGwKcEBANOkzIHZS5p6SPPT61awRjdFUL7VwUED
N5Mc0ZM+0MMM
=OqGV
-----END PGP SIGNATURE-----