CVE-2022-29177: Denial of Service via malicious p2p message in Go Ethereum
Summary
CVE-2022-29177: DoS via malicious p2p message in Go Ethereum. Affects github.com/ethereum/go-ethereum versions < 1.10.17. Fixed in 1.10.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Ethereum (Geth) is an implementation of the Ethereum protocol written in the Go programming language. It is widely used as a client for interacting with the Ethereum blockchain. Geth allows users to run a full Ethereum node, participate in the network, and execute smart contracts. This vulnerability affects Geth versions prior to 1.10.17.
Vulnerability Detail
This vulnerability allows an attacker to crash a vulnerable Geth node by sending specially crafted p2p messages. If the node is configured to use high verbosity logging, it can be made to crash when handling these malicious messages. The impact of this vulnerability is a denial of service (DoS) attack, which can disrupt the availability of the affected node. The vulnerability was reported by a security researcher and has been assigned CVE-2022-29177.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.17
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.10.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Geth is not immediately feasible, an alternative workaround is to set the loglevel to the default level (INFO). This can be done by modifying the node's configuration. By setting the loglevel to INFO, the node will not be vulnerable to this specific attack. However, it is still recommended to update Geth to the latest version as soon as possible.
Conclusion
The vulnerability in Go Ethereum (Geth) allows an attacker to crash a vulnerable node by sending malicious p2p messages. To mitigate this vulnerability, it is recommended to update Geth to version 1.10.17 or later. Alternatively, setting the loglevel to INFO can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
Go Ethereum (Geth) is an implementation of the Ethereum protocol written in the Go programming language. It allows users to run a full Ethereum node, participate in the network, and execute smart contracts.
The impact of this vulnerability is a denial of service (DoS) attack, which can crash a vulnerable Geth node and disrupt its availability.
To fix this vulnerability, update Geth to version 1.10.17 or later. Alternatively, set the loglevel to INFO as a temporary workaround.
Yes, the fix for this vulnerability can be found in the following pull request: https://github.com/ethereum/go-ethereum/pull/24507.
This vulnerability was reported by a security researcher named nrv via bounty@ethereum.org. The researcher has requested that the bounty rewards be donated to Médecins sans frontières.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
