CVE-2025-70957 identifies a Denial of Service vulnerability in the TON Lite Server, a component that processes blockchain-related requests via "get methods." The vulnerability arises because the server accepts external arguments that can include a crafted Continuation object, a specialized internal type used by the TON Virtual Machine (TVM) to represent deferred computations. Under normal operation, Continuation objects are tightly controlled within the VM environment to prevent abuse. However, due to insufficient validation, an attacker can inject a malicious Continuation that, when executed, triggers excessive CPU consumption. This is exacerbated by the fact that the virtual gas accounting mechanism, which normally limits resource usage, underestimates the cost of this computation, effectively allowing the attacker to perform expensive operations for free. The result is that the Lite Server's processing capacity is overwhelmed, reducing throughput and causing denial of service for legitimate users accessing services through the gateway. The vulnerability affects all versions before v2024.09, with no patch links currently available. No authentication or user interaction is required to exploit this flaw, making it accessible to remote attackers. Although no known exploits have been reported in the wild, the technical details suggest a straightforward attack vector that could be weaponized once public knowledge spreads. The vulnerability highlights the risks of inadequate input validation and resource accounting in blockchain virtual machines and their associated infrastructure.

For European organizations utilizing TON Lite Server infrastructure, this vulnerability can lead to significant service disruptions. Organizations relying on blockchain services, decentralized applications, or gateways powered by TON technology may experience degraded performance or complete denial of service, impacting business continuity and user trust. The excessive CPU consumption could also increase operational costs due to resource exhaustion and potential cascading failures in dependent systems. Critical services that depend on timely blockchain data retrieval or transaction processing could be delayed or halted, affecting sectors such as finance, supply chain, and public services that increasingly integrate blockchain solutions. Additionally, the inability to process legitimate requests may open avenues for secondary attacks or exploitation of fallback mechanisms. The lack of authentication requirement broadens the attack surface, allowing external threat actors to launch DoS attacks without insider access. Given the growing adoption of blockchain technologies in Europe, especially in countries with strong fintech and technology sectors, the impact could be widespread if not mitigated promptly.

Immediate mitigation steps include implementing strict input validation on all external arguments passed to the "get methods" to ensure that Continuation objects cannot be injected or executed unless verified and authorized. Monitoring CPU usage patterns and virtual gas consumption metrics can help detect anomalous behaviors indicative of exploitation attempts. Rate limiting and request throttling on the gateway can reduce the risk of resource monopolization. Network-level protections such as Web Application Firewalls (WAFs) configured to identify and block malformed or suspicious requests targeting the vulnerable methods should be deployed. Organizations should prioritize upgrading to TON Lite Server versions at or beyond v2024.09 once patches are released. Until patches are available, isolating the Lite Server in a controlled environment with limited exposure to untrusted networks can reduce risk. Collaborating with the TON development community to obtain early access to fixes and sharing threat intelligence within European cybersecurity forums will enhance preparedness. Finally, conducting regular security audits and penetration testing focused on blockchain infrastructure can uncover similar vulnerabilities proactively.