GitHub Advisoryadvisory · Go

GHSA-m6j8-rg6r-7mv8 Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

MEDIUM Published 2026-02-18 Modified 2026-02-27 Official page ↗
Aliases
CVE-2026-26315
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-203
Reviewed
2026-02-18

Affected packages

• Go github.com/ethereum/go-ethereum: < 1.16.9 → fixed in 1.16.9

Description

Impact Through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. Patches The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. We recommend rotating the node key after applying the upgrade, which can be done by removing the file `/geth/nodekey` before starting Geth. Credit The issue was reported as a public pull request to go-ethereum by @fengjian.

Related

Alias · CVE (1)

  • CVE-2026-26315 go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References