Ethereum
CVE-2026-26314
HIGH
GHSA-2gjw-fg97-vg3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed network message
-
ExploitSend to vulnerable geth node
-
ExecutionTrigger parsing flaw
-
ImpactNode crashes or shuts down
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Geth versions prior to 1.16.9 or 1.17.0 with network port exposed to untrusted peers. Attacker must reach the node's P2P listening port (default 30303). |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Geth versions prior to 1.16.9 can be remotely crashed by sending a specially crafted message over the network, allowing unauthenticated attackers to cause denial of service against Ethereum nodes. This vulnerability in Go Ethereum's message handling requires no user interaction and affects the availability of affected nodes. Patched versions 1.16.9 and 1.17.0 are available to remediate this issue.
Earlier versions of this analysis (1)
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. [CVSS 7.5 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-20 (Improper Input Validation). Affects Go Ethereum. go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.
Know when Ethereum gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.
Executive ViewAI
Go-ethereum nodes running versions prior to 1.16.9 are vulnerable to denial-of-service attacks that can force nodes to crash via specially crafted messages. Organizations operating Ethereum infrastructure, validators, or blockchain services are at risk of service disruption and potential financial impact from downtime.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas pri
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of servi
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an at
Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length
cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted byte
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and
Circuit soundness failure in Payy (polybase/payy) prior to 1.3.0 lets an authorized rollup prover smuggle an extra burn
Go Ethereum (geth) nodes can be remotely crashed through maliciously crafted network messages, causing denial of service
Go Ethereum nodes can be remotely crashed by unauthenticated attackers sending specially crafted network messages, resul
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB