go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node

HOCH 7.5CVE-2026-22862 · GHSA-mr7q-c9w9-wh4h · GO-2026-4315 · Published 13/01/2026 · updated 17/06/2026

Kurz gesagt

CVE-2026-22862 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/ethereum/go-ethereum, go ethereum (ethereum).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.2% aller Schwachstellen.
Abhilfe: auf 1.16.8 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22862 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

Weitere Schwachstellen in github.com/ethereum/go-ethereum

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.

NVD description

Weitere Schwachstellen in github.com/ethereum/go-ethereum

Alle anzeigen →