GitHub Advisoryadvisory · Go

GHSA-689v-6xwf-5jf3 Go Ethereum affected by DoS via malicious p2p message

MEDIUM Published 2026-02-18 Modified 2026-02-27 Official page ↗
Aliases
CVE-2026-26313
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-02-18

Affected packages

• Go github.com/ethereum/go-ethereum: < 1.17.0 → fixed in 1.17.0

Description

Impact An attacker can cause high memory usage by sending a specially-crafted p2p message. More details to be released later. Patches The issue is resolved in the v1.17.0 release. Credit This issue was reported to the Ethereum Foundation Bug Bounty Program by @revofusion

Related

Alias · CVE (1)

  • CVE-2026-26313 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References