CVE-2021-39137

The CVE-2021-39137 entry concerns go-ethereum (Geth). A memory-corruption/consensus flaw in the EVM can cause a node to reject or diverge from the canonical chain, potentially leading to chain splits as described in multiple advisories. A patch is included in the v1.10.8 release; no workaround is...

CVE-2022-37450

Go Ethereum (geth)

CVE-2022-29177

CVE-2022-29177 affects the Go Ethereum (go-ethereum) client. Before version 1.10.17, a node configured with high verbosity logging could crash when processing specially crafted p2p messages from a attacker node. A patch in v1.10.17 addresses the issue; as a workaround, setting the log level to IN...

CVE-2022-23328

CVE-2022-23328 describes a design flaw in all versions of Go-Ethereum whereby an attacker node can inject 5,120 pending transactions with high gas prices from a single account. This behavior can purge the victim node’s memory pool of pending transactions and then saturate the pool, blocking new t...

CVE-2022-23327

Go-Ethereum versions 1.10.12 and earlier contain a design flaw that allows an attacker node to flood a victim’s memory pool by sending 5,120 future transactions with high gas price in a single message, causing memory pool purge and denial of service (DoS). Affected software is Go-Ethereum; root c...

CVE-2021-42219

CVE-2021-42219 affects Go-Ethereum v1.10.9, where a DoS condition can be triggered by an excessive flow of messages to a node. The root cause, as described in the sources, is missing memory in the /ethash/algorithm.go component. Public documentation (NVD/NVD-derived sources and multiple advisorie...

CVE-2020-26240

CVE-2020-26240 affects Go Ethereum (Geth). The issue is an ethash mining DAG generation flaw that could cause miners to compute PoW incorrectly in an upcoming epoch; non-mining nodes are unaffected. Affected software: Geth prior to version 1.9.24. Root cause: DAG generation flaw in ethash logic. ...

CVE-2020-26241

CVE-2020-26241 is a consensus vulnerability in the Go Ethereum (Geth) client prior to version 1.9.17. A crafted contract can trigger a mismatch between the EVM’s RETURNDATACOPY path and Geth’s execution by exploiting a shallow copy bug in the pre-compiled dataCopy contract (0x0000…04). An attacke...

CVE-2020-26264

Go Ethereum (Geth) before v1.9.25 is vulnerable to a denial-of-service affecting the LES server via a malicious GetProofsV2 request from a connected LES client. The issue only concerns users who explicitly enable the LES server; disabling LES prevents exploitation. The vulnerability was fixed in ...

CVE-2023-40591

Summary: Go-Ethereum (geth) vulnerable to Denial of Service via unbounded memory consumption when processing specially crafted p2p messages from an attacker node. The root cause is memory exhaustion triggered by handling crafted p2p messages; a vulnerable node can allocate unbounded memory, poten...

CVE-2020-26242

Go Ethereum (Geth) before version 1.9.18 is vulnerable to a Denial-of-Service (crash) during block processing. The issue stems from the uint256 library behavior (buffer underflow in MULMOD when modulo is 0), which can cause a panic and network-wide node drops if exploited. A fix was released by u...

CVE-2021-41173

CVE-2021-41173 affects go-ethereum prior to v1.10.9, where processing a malicious snap/1 message could crash a node (DoS). The Red Hat and OSV details corroborate a crash in Go Ethereum’s P2P handling, specifically the GetTrieNodes path in the snap protocol. The root cause involved unsafe handlin...

CVE-2023-42319

CVE-2023-42319 affects Geth (go-ethereum) up to v1.13.4 when running with --http and --graphql. The vulnerability allows remote attackers to trigger a denial of service by sending a crafted GraphQL query, leading to memory exhaustion and a daemon hang. The issue is a DoS condition caused by how t...

CVE-2018-12018

CVE-2018-12018 affects Go Ethereum (geth) LES GetBlockHeadersMsg handling prior to v1.8.11. An integer signedness error for the array index allows a crafted query with Skip = -1 to crash a remote node (EPoD). The vulnerability occurs when the server validates the requested headers after skipping ...

CVE-2018-19184

CVE-2018-19184 affects Go Ethereum (geth) prior to or including 1.8.17, specifically in cmd/evm/runner.go. The vulnerability allows an attacker to trigger a denial-of-service (SEGV) through specially crafted bytecode, as documented in multiple sources (NVD entry for CVE-2018-19184 and SUSE/GHSA e...

CVE-2021-43668

Go-Ethereum, version 1.10.9, is affected by a vulnerability that can cause a denial-of-service crash. The issue manifests as a runtime error: invalid memory address or nil pointer dereference, leading to a SEGV signal after the node processes a sequence of messages and cannot recover. The provide...

CVE-2018-16733

CVE-2018-16733 affects go-ethereum (geth) prior to 1.8.14, where TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. The vulnerability’s root cause is improper validation in the tracing path, potentially enabling malformed block processing and, in some des...

CVE-2020-26265

Go Ethereum (Geth) up to v1.9.19 (inclusive) is affected by a consensus vulnerability that could lead to a chain split where non-canonical chains are rejected. The issue stems from how state/account creation interacted with deleted accounts, causing inconsistent consensus under certain transactio...

CVE-2018-20421

CVE-2018-20421 affects Go Ethereum (aka geth) version 1.8.19, where an attacker can cause a denial of service via memory consumption by rewriting the length of a dynamic array in memory and then writing to a single memory location with a large index (illustrated by using assembly { mstore } follo...

CVE-2026-22868

CVE-2026-22868 affects go-ethereum (geth). A vulnerable node can be forced to shutdown or crash by processing a specially crafted P2P message; multiple sources describe a DoS/Crash risk with high impact, including high CPU usage leading to DoS under certain advisories. The vulnerability is tied t...

CVE-2026-26313

CVE-2026-26313 (go-ethereum - Geth) : Prior to version 1.17.0, the Go Ethereum (geth) node is vulnerable to a DoS caused by memory exhaustion when processing a specially crafted P2P message. The issue is resolved in v1.17.0. Connected sources corroborate a network-exposed vulnerability in go-ethe...

CVE-2026-26315

Go Ethereum (Geth) before v1.16.9 is affected by a flaw in the ECIES cryptography implementation that can allow an attacker to extract bits of the p2p node key. The issue is fixed in v1.16.9 and v1.17.0. After upgrading, rotate the node key by removing the file /geth/nodekey before restarting Get...

CVE-2026-22862

CVE-2026-22862 (go-ethereum/geth) : A DoS vulnerability affecting the Go implementation of the Ethereum protocol allows a vulnerable node to be forced to shutdown/crash by processing a specially crafted p2p message. Public sources (NVD, Red Hat, CIRCL/OSVGHSA) tie the issue to geth and indicate a...

CVE-2026-26314

CVE-2026-26314 (go-ethereum / geth): Prior to version 1.16.9, a vulnerable node can be forced to shutdown or crash by processing a specially crafted p2p message. The issue is resolved in v1.16.9 and v1.17.0 releases. Affected software: go-ethereum (Geth) execution layer of the Ethereum protocol. ...