Denial of service in github.com/ethereum/go-ethereum

TRUNG BÌNH 6.5CVE-2020-26264 · GHSA-r33q-22hv-j29q · GO-2021-0063 · Công bố 11/12/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-26264 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng github.com/ethereum/go-ethereum, go ethereum (ethereum).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.9%, cao hơn 79.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.9.25 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/ethereum/go-ethereum Go	`< 1.9.25`	`1.9.25`
go ethereum ethereum	`< 1.9.25`	`1.9.25`

Mô tả

Impact

A DoS vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client.

Patches

The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896.

Workarounds

This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896.

For more information

If you have any questions or comments about this advisory:

Open an issue in go-ethereum
Email us at [email protected]

Mô tả của NVD

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.