CVE-2021-43668: Denial of Service in Go-Ethereum

github.com/ethereum/go-ethereum Updated 02 Oct 2025

Summary

23/11/2021

Disclosed on

CVE-2021-43668

CVE

No i

Fix available

Moderate

Severity

5.5

CVSS Score

CVE-2021-43668: Denial of Service in Go-Ethereum. Affects github.com/ethereum/go-ethereum versions < 1.10.9. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Go-Ethereum is a popular Go implementation of the Ethereum protocol. It is used to run Ethereum nodes, which participate in the Ethereum network by validating transactions and executing smart contracts. Go-Ethereum provides a robust and efficient platform for developers to interact with the Ethereum blockchain. However, a vulnerability has been discovered in versions up to and including 1.10.9 that can lead to a denial of service (DoS) attack.

Vulnerability Detail

The vulnerability in Go-Ethereum allows an attacker to crash nodes by sending a series of malicious messages. Once the nodes receive these messages, they become unresponsive and cannot be recovered. The crash is triggered by an invalid memory address or nil pointer dereference, resulting in a runtime error. This vulnerability poses a moderate risk as it can disrupt the availability of Ethereum nodes and potentially impact the stability of the Ethereum network.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is currently no known workaround for this vulnerability. It is essential to apply the patch provided by the Go-Ethereum developers to mitigate the risk of a DoS attack.

Conclusion

The vulnerability in Go-Ethereum can result in a denial of service (DoS) attack, causing Ethereum nodes to crash and become unresponsive. To mitigate this risk, users should update their Go-Ethereum installations to the latest version available. Regularly checking for updates and promptly applying them is essential to ensure the security and stability of Ethereum nodes. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/ethereum/go-ethereum →