go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

HIGH 7.5CVE-2026-22868 · GHSA-mq3p-rrmp-79jg · GO-2026-4314 · Published 13/01/2026 · updated 17/06/2026

In short

CVE-2026-22868 is a HIGH (CVSS 7.5) vulnerability affecting github.com/ethereum/go-ethereum, go ethereum (ethereum).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.0% of all vulnerabilities.
Fix: update to 1.16.8 or later.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22868 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

More vulnerabilities in github.com/ethereum/go-ethereum

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

More vulnerabilities in github.com/ethereum/go-ethereum

See all →