go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

ÉLEVÉE 7.5CVE-2026-22868 · GHSA-mq3p-rrmp-79jg · GO-2026-4314 · Published 13/01/2026 · updated 17/06/2026

En bref

CVE-2026-22868 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant github.com/ethereum/go-ethereum, go ethereum (ethereum).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.63%, plus élevée que 50.0% des vulnérabilités.
Correctif : mettre à jour vers 1.16.8 ou plus récent.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22868 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

Autres vulnérabilités de github.com/ethereum/go-ethereum

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

Autres vulnérabilités de github.com/ethereum/go-ethereum

Tout voir →