go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

ALTO 7.5CVE-2026-22868 · GHSA-mq3p-rrmp-79jg · GO-2026-4314 · Published 13/01/2026 · updated 17/06/2026

In breve

CVE-2026-22868 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/ethereum/go-ethereum, go ethereum (ethereum).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.63%, superiore al 50.0% delle vulnerabilità.
Correzione: aggiornare a 1.16.8 o successiva.

Package	Affected versions	Patched versions
github.com/ethereum/go-ethereum Go	`< 1.16.8`	`1.16.8`
go ethereum ethereum	`< 1.16.8`	`1.16.8`

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

References

ethereum/go-ethereum security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22868 · ADVISORY
ethereum/go-ethereum commit abeb78c · WEB
ethereum/go-ethereum · PACKAGE

Altre vulnerabilità di github.com/ethereum/go-ethereum

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/ethereum/go-ethereum

< 1.16.8

1.16.8

go ethereum

ethereum

< 1.16.8

1.16.8

Description

Impact

An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030

NVD description

Altre vulnerabilità di github.com/ethereum/go-ethereum

Vedi tutto →