go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node

ALTO 7.5CVE-2026-22862 · GHSA-mr7q-c9w9-wh4h · GO-2026-4315 · Published 13/01/2026 · updated 17/06/2026

En resumen

CVE-2026-22862 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a github.com/ethereum/go-ethereum, go ethereum (ethereum).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.73%, mayor que el 54.2% de las vulnerabilidades.
Solución: actualizar a 1.16.8 o posterior.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22862 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

Más vulnerabilidades de github.com/ethereum/go-ethereum

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.

NVD description

Más vulnerabilidades de github.com/ethereum/go-ethereum

Ver todo →