go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

ALTO 7.5CVE-2026-22868 · GHSA-mq3p-rrmp-79jg · GO-2026-4314 · Published 13/01/2026 · updated 17/06/2026

En resumen

CVE-2026-22868 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a github.com/ethereum/go-ethereum, go ethereum (ethereum).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.63%, mayor que el 50.0% de las vulnerabilidades.
Solución: actualizar a 1.16.8 o posterior.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22868 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

Más vulnerabilidades de github.com/ethereum/go-ethereum

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

Más vulnerabilidades de github.com/ethereum/go-ethereum

Ver todo →