CVE-2020-26241: Shallow copy bug in geth
Summary
CVE-2020-26241: Shallow copy bug in geth. Affects github.com/ethereum/go-ethereum versions >= 1.9.7, < 1.9.17. Fixed in 1.9.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/ethereum/go-ethereum, which is written in Go and is part of the Ethereum ecosystem. It is a widely used package for interacting with the Ethereum blockchain. The vulnerability affects versions 1.9.7 to 1.9.16 of the package. The package provides a pre-compiled dataCopy contract that performs a shallow copy on invocation. This vulnerability can be exploited by an attacker to cause a chain-split, where vulnerable nodes reject the canonical chain.
Vulnerability Detail
The vulnerability arises from the shallow copy performed by the dataCopy contract. An attacker can deploy a contract that writes a value X to a specific memory region R, then calls the dataCopy contract with R as an argument. The attacker can then overwrite the value of R to Y and invoke the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, while Geth would push Y. This inconsistency can lead to a chain-split and rejection of the canonical chain.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.17
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.9.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The github.com/ethereum/go-ethereum package is vulnerable to a shallow copy bug in the dataCopy contract, which can lead to a chain-split. Users of this package should upgrade to version 1.9.17 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
This vulnerability can cause a chain-split, where vulnerable nodes reject the canonical chain.
An attacker can deploy a contract that exploits the shallow copy bug in the dataCopy contract to manipulate the EVM stack and cause a chain-split.
Versions 1.9.7 to 1.9.16 of the github.com/ethereum/go-ethereum package are affected.
Yes, upgrading to version 1.9.17 or later of the github.com/ethereum/go-ethereum package fixes this vulnerability.
No, there are no known workarounds. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
