github.com/ethereum/go-ethereum

Version	Released
`v1.17.10` patch	Oct 23, 2026
`v1.17.9` patch	Oct 21, 2026
`v1.17.8` patch	Oct 08, 2026
`v1.17.7` patch	Sep 30, 2026
`v1.17.6` patch	Sep 23, 2026
`v1.17.5` patch	Jul 27, 2026
`v1.17.4` patch	Jun 22, 2026
`v1.17.3` patch	May 11, 2026
`v1.17.2` patch	Mar 30, 2026
`v1.17.1` patch	Mar 03, 2026
`v1.17.0` minor	Feb 17, 2026
`v1.16.9` patch 1 CVE	Feb 17, 2026
`v1.16.8` patch 3 CVEs	Jan 13, 2026
`v1.16.7` patch 5 CVEs	Nov 04, 2025
`v1.16.6` patch 5 CVEs	Nov 03, 2025
`v1.16.5` patch 5 CVEs	Oct 16, 2025
`v1.16.4` patch 5 CVEs	Sep 25, 2025
`v1.16.3` patch 5 CVEs	Sep 01, 2025
`v1.16.2` patch 5 CVEs	Aug 04, 2025
`v1.16.1` patch 5 CVEs	Jul 02, 2025
`v1.16.0` minor 5 CVEs	Jun 26, 2025
`v1.15.11` patch 5 CVEs	May 05, 2025
`v1.15.10` patch 5 CVEs	Apr 25, 2025
`v1.15.9` patch 5 CVEs	Apr 21, 2025
`v1.15.8` patch 5 CVEs	Apr 11, 2025
`v1.15.0` minor 5 CVEs	Feb 06, 2025
`v1.14.2` minor 6 CVEs	May 08, 2024
`v1.13.10` patch 6 CVEs	Jan 11, 2024
`v1.13.8` patch 6 CVEs	Dec 22, 2023
`v1.13.7` patch 6 CVEs	Dec 19, 2023
`v1.13.5` patch 6 CVEs	Nov 14, 2023
`v1.13.4` patch 7 CVEs	Oct 17, 2023
`v1.13.0` minor 7 CVEs	Sep 12, 2023
`v1.11.5` patch 8 CVEs	Mar 21, 2023
`v1.11.1` minor 8 CVEs	Feb 16, 2023
`v1.10.22` patch 8 CVEs	Aug 22, 2022
`v1.10.21` patch 9 CVEs	Jul 27, 2022
`v1.10.19` patch 9 CVEs	Jun 15, 2022
`v1.10.17` patch 9 CVEs	Mar 29, 2022
`v1.10.14` patch 11 CVEs	Dec 23, 2021
`v1.10.13` patch 11 CVEs	Nov 24, 2021
`v1.10.6` patch 16 CVEs	Jul 22, 2021
`v1.10.5` patch 16 CVEs	Jul 14, 2021
`v1.10.3` minor 16 CVEs	May 05, 2021
`v1.9.25` patch 16 CVEs	Dec 11, 2020
`v1.9.16` patch 22 CVEs	Jul 10, 2020
`v1.9.14` patch 21 CVEs	May 13, 2020
`v1.9.5` patch 20 CVEs	Sep 20, 2019
`v1.9.2` minor 19 CVEs	Aug 13, 2019
`v0.4.2` initial 22 CVEs	Jun 28, 2019

v1.17.10 patch

Oct 23, 2026

v1.17.9 patch

Oct 21, 2026

v1.17.8 patch

Oct 08, 2026

v1.17.7 patch

Sep 30, 2026

v1.17.6 patch

Sep 23, 2026

v1.17.5 patch

Jul 27, 2026

v1.17.4 patch

Jun 22, 2026

v1.17.3 patch

May 11, 2026

v1.17.2 patch

Mar 30, 2026

v1.17.1 patch

Mar 03, 2026

v1.17.0 minor

Feb 17, 2026

v1.16.9 patch

1 CVE

Feb 17, 2026

v1.16.8 patch

3 CVEs

Jan 13, 2026

v1.16.7 patch

5 CVEs

Nov 04, 2025

v1.16.6 patch

5 CVEs

Nov 03, 2025

v1.16.5 patch

5 CVEs

Oct 16, 2025

v1.16.4 patch

5 CVEs

Sep 25, 2025

v1.16.3 patch

5 CVEs

Sep 01, 2025

v1.16.2 patch

5 CVEs

Aug 04, 2025

v1.16.1 patch

5 CVEs

Jul 02, 2025

v1.16.0 minor

5 CVEs

Jun 26, 2025

v1.15.11 patch

5 CVEs

May 05, 2025

v1.15.10 patch

5 CVEs

Apr 25, 2025

v1.15.9 patch

5 CVEs

Apr 21, 2025

v1.15.8 patch

5 CVEs

Apr 11, 2025

v1.15.0 minor

5 CVEs

Feb 06, 2025

v1.14.2 minor

6 CVEs

May 08, 2024

v1.13.10 patch

6 CVEs

Jan 11, 2024

v1.13.8 patch

6 CVEs

Dec 22, 2023

v1.13.7 patch

6 CVEs

Dec 19, 2023

v1.13.5 patch

6 CVEs

Nov 14, 2023

v1.13.4 patch

7 CVEs

Oct 17, 2023

v1.13.0 minor

7 CVEs

Sep 12, 2023

v1.11.5 patch

8 CVEs

Mar 21, 2023

v1.11.1 minor

8 CVEs

Feb 16, 2023

v1.10.22 patch

8 CVEs

Aug 22, 2022

v1.10.21 patch

9 CVEs

Jul 27, 2022

v1.10.19 patch

9 CVEs

Jun 15, 2022

v1.10.17 patch

9 CVEs

Mar 29, 2022

v1.10.14 patch

11 CVEs

Dec 23, 2021

v1.10.13 patch

11 CVEs

Nov 24, 2021

v1.10.6 patch

16 CVEs

Jul 22, 2021

v1.10.5 patch

16 CVEs

Jul 14, 2021

v1.10.3 minor

16 CVEs

May 05, 2021

v1.9.25 patch

16 CVEs

Dec 11, 2020

v1.9.16 patch

22 CVEs

CVE-2026-26315 GO-2026-4511 GHSA-m6j8-rg6r-7mv8 Feb 24, 2026

Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereum

Fixed in


          1.16.9

References

Updated Feb 24, 2026 · Source: OSV.dev

CVE-2026-26314 GO-2026-4507 GHSA-2gjw-fg97-vg3r Feb 24, 2026

Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum

Fixed in


          1.16.9

References

Updated Feb 24, 2026 · Source: OSV.dev

CVE-2026-26313 GO-2026-4508 GHSA-689v-6xwf-5jf3 Feb 24, 2026

Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum

Fixed in


          1.17.0

References

Updated Feb 24, 2026 · Source: OSV.dev

CVE-2026-22868 GO-2026-4314 GHSA-mq3p-rrmp-79jg Jan 23, 2026

High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum

Fixed in


          1.16.8

References

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2026-22862 GO-2026-4315 GHSA-mr7q-c9w9-wh4h Jan 23, 2026

DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum

Fixed in


          1.16.8

References

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2020-26240 GO-2022-0775 GHSA-v592-xf75-856p Aug 21, 2024

Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereum

Fixed in


          1.9.24

References

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2020-26241 GO-2022-0771 GHSA-69v6-xc2j-r2jf Aug 21, 2024

Shallow copy bug in geth in github.com/ethereum/go-ethereum

Fixed in


          1.9.17

References

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2022-29177 GO-2022-0456 GHSA-wjxw-gh3m-7pm5 Aug 21, 2024

DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum

Fixed in


          1.10.17

References

Updated Mar 03, 2026 · Source: OSV.dev

GO-2022-0392 GHSA-m6gx-rhvj-fh52 Aug 21, 2024

Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum

Fixed in


          1.9.24

References

https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2024-32972 GO-2024-2819 GHSA-4xc9-8hmq-j652 May 08, 2024

Denial of Service in github.com/ethereum/go-ethereum

A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. This can result in a denial of service as the node runs out of memory.

Fixed in


          1.13.15

References

https://github.com/advisories/GHSA-4xc9-8hmq-j652

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2023-40591 GO-2023-2046 GHSA-ppjg-v974-84cm Oct 25, 2023

Unbounded memory consumption in github.com/ethereum/go-ethereum

Fixed in


          1.12.1

References

https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm

Updated Mar 03, 2026 · Source: OSV.dev

CVE-2023-42319 GHSA-v9jh-j8px-98vq Oct 18, 2023

go-ethereum vulnerable to denial of service via crafted GraphQL query

7.5 / 10

High

Network Low None None Unchanged None None High

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query.

NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.

References

Updated Sep 13, 2024 · Source: OSV.dev

CVE-2022-37450 GHSA-rqmg-hrg4-fm69 Aug 06, 2022

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

5.9 / 10

Medium

Network High None None Unchanged None High None

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2021-41173 GO-2022-0256 GHSA-59hh-656j-3p7v Jul 15, 2022

Panic via maliciously crafted message in github.com/ethereum/go-ethereum

A maliciously crafted snap/1 protocol message can cause a panic.

Fixed in


          1.10.9

References

https://github.com/ethereum/go-ethereum/pull/23657/commits/f1fd963a5a965e643e52fcf805a2a02a323c32b8

Updated May 20, 2024 · Source: OSV.dev

CVE-2021-39137 GO-2022-0254 GHSA-9856-9gg9-qcmq Jul 15, 2022

Consensus flaw during block processing in github.com/ethereum/go-ethereum

A vulnerability in the Geth EVM can cause a node to reject the canonical chain.

A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different stateRoot when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split in two forks.

Fixed in


          1.10.8

References

https://github.com/ethereum/go-ethereum/pull/23381/commits/4d4879cafd1b3c906fc184a8c4a357137465128f

Updated May 20, 2024 · Source: OSV.dev

CVE-2021-42219 GHSA-vrcc-g6vj-mh5w Mar 18, 2022

Denial of service in go-ethereum

7.5 / 10

High

Network Low None None Unchanged None None High

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2022-23328 GHSA-vmf7-hmh6-vv57 Mar 05, 2022

Denial of Service in Go-Ethereum

7.5 / 10

High

Network Low None None Unchanged None None High

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2022-23327 GHSA-pvx3-gm3c-gmpr Mar 05, 2022

Denial of Service in Go-Ethereum

7.5 / 10

High

Network Low None None Unchanged None None High

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).

References

Updated Sep 02, 2026 · Source: OSV.dev

CVE-2021-43668 GHSA-5m8f-chrv-7rw5 Nov 23, 2021

Denial of Service in Go-Ethereum

5.5 / 10

Medium

Local Low Low None Unchanged None None High

Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.

References

Updated Nov 08, 2023 · Source: OSV.dev

CVE-2020-26265 GO-2021-0105 GHSA-xw37-57qp-9mm4 Jul 28, 2021

Consensus flaw in github.com/ethereum/go-ethereum

Due to an incorrect state calculation, a specific set of transactions could cause a consensus disagreement, causing users of this package to reject a canonical chain.

Fixed in


          1.9.20

References

Updated May 20, 2024 · Source: OSV.dev

CVE-2020-26264 GHSA-r33q-22hv-j29q GO-2021-0063 Jun 29, 2021

Denial of service in github.com/ethereum/go-ethereum

6.5 / 10

Medium

Network Low Low None Unchanged None None High

Impact

A DoS vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client.

Patches

The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896.

Workarounds

This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896.

For more information

If you have any questions or comments about this advisory:

Open an issue in go-ethereum
Email us at security@ethereum.org

Fixed in


          1.9.25

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2020-26242 GHSA-jm5c-rv3w-w83m GO-2021-0103 Jun 29, 2021

Denial of service in geth

6.5 / 10

Medium

Network Low Low None Unchanged None None High

Impact

Denial-of-service (crash) during block processing

Details

Affected versions suffer from a vulnerability which can be exploited through the MULMOD operation, by specifying a modulo of 0: mulmod(a,b,0), causing a panic in the underlying library. The crash was in the uint256 library, where a buffer underflowed.

if `d == 0`, `dLen` remains `0`

and https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index [-1].

The uint256 library was first merged in this commit, on 2020-06-08. Exploiting this vulnerabilty would cause all vulnerable nodes to drop off the network.

The issue was brought to our attention through a bug report, showing a panic occurring on sync from genesis on the Ropsten network.

It was estimated that the least obvious way to fix this would be to merge the fix into uint256, make a new release of that library and then update the geth-dependency.

https://github.com/holiman/uint256/releases/tag/v1.1.1 was made the same day,
PR to address the issue: https://github.com/holiman/uint256/pull/80
PR to update geth deps: https://github.com/ethereum/go-ethereum/pull/21368

Patches

Upgrade to v1.9.18 or higher

Workarounds

Not at this time

References

https://blog.ethereum.org/2020/11/12/geth_security_release/

For more information

If you have any questions or comments about this advisory:

Open an issue in go-ethereum
Email us at security@ethereum.org

Fixed in


          1.9.18

References

Updated Jul 08, 2026 · Source: OSV.dev

Jul 10, 2020

v1.9.14 patch

21 CVEs

May 13, 2020

v1.9.5 patch

20 CVEs

Sep 20, 2019

v1.9.2 minor

19 CVEs

Aug 13, 2019

v0.4.2 initial

22 CVEs

Jun 28, 2019

Activity

Reach

Details

Impact

Patches

Workarounds

For more information

Impact

Details

Patches

Workarounds

References

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Specific Go Packages Affected

Impact

Patches

Workarounds

For more information