Ethereum
CVE-2026-26315
HIGH
GHSA-m6j8-rg6r-7mv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to vulnerable Geth p2p node
-
ExploitExploit ECIES cryptography flaw
-
ExecutionExtract p2p node key bits
-
ImpactCompromise node identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V6 - Authentication Timing-safe comparisons
|
| Exploitation Conditions | Geth versions prior to 1.16.9 or 1.17.0 with p2p networking enabled. Attacker requires network access to the node's p2p port (default 30303) without authentication required. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Go Ethereum (Geth) versions prior to 1.16.9 contain a cryptographic implementation flaw in ECIES that allows remote attackers to extract portions of the p2p node key without authentication. This exposure could compromise the confidentiality of node communications and potentially enable impersonation or network-level attacks against affected Ethereum nodes. Administrators should upgrade to version 1.16.9 or later and rotate their node keys by deleting the nodekey file.
Earlier versions of this analysis (1)
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Go Ethereum. go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file <datadir>/geth/nodekey before starting Geth.
Know when Ethereum gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file <datadir>/geth/nodekey before starting Geth.
Executive ViewAI
A HIGH severity vulnerability in go-ethereum (Geth) could allow attackers to extract cryptographic key material from Ethereum nodes, potentially compromising network communications and node security. Organizations running Geth versions prior to 1.16.9 face immediate risk of p2p node key exposure, which could enable node impersonation, network surveillance, or consensus attacks.
Network segmentation: restrict p2p port access (default 30303) to whitelisted peers only via firewall rules. Disable UPnP/NAT-PMP to prevent automatic port exposure. Implement egress filtering to limit node communication to essential peers. Monitor for suspicious peer connections and implement peer reputation systems. Consider running nodes in isolated network segments with minimal trust from broader infrastructure. Rotate node keys frequently as a temporary measure. Monitor Geth repository releases for patch availability—no current patch exists; apply immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas pri
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of servi
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an at
Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length
cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted byte
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and
Circuit soundness failure in Payy (polybase/payy) prior to 1.3.0 lets an authorized rollup prover smuggle an extra burn
Geth versions prior to 1.16.9 can be remotely crashed by sending a specially crafted message over the network, allowing
Go Ethereum (geth) nodes can be remotely crashed through maliciously crafted network messages, causing denial of service
Same weakness CWE-203 – Observable Discrepancy
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB