CVE-2026-26314: Go Ethereum DoS Vulnerability via Malicious p2p Message
Summary
CVE-2026-26314: Go Ethereum affected by DoS via malicious p2p message. Affects github.com/ethereum/go-ethereum versions < 1.16.9. Fixed in 1.16.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Go Ethereum, commonly known as Geth, is the official Go implementation of the Ethereum protocol. It serves as a full node client that allows users to interact with the Ethereum blockchain, facilitating transactions, smart contracts, and decentralized applications. Geth is widely used due to its performance, reliability, and active community support. However, it has been found to be vulnerable to a Denial of Service (DoS) attack through specially crafted peer-to-peer (p2p) messages, which can cause a vulnerable node to crash or shut down unexpectedly.
Vulnerability Detail
The vulnerability arises from the handling of p2p messages within the Go Ethereum client. An attacker can exploit this flaw by sending a specifically crafted message to a vulnerable node, leading to a forced shutdown or crash of the node. This can disrupt services relying on the Ethereum network, potentially affecting transactions and smart contracts. The issue has been classified under CWE-20, indicating improper input validation, which is critical for maintaining the stability and security of the network.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16.9
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.16.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The Go Ethereum DoS vulnerability (CVE-2026-26314) poses a significant risk to nodes running affected versions of the software. Users are strongly advised to update to the latest patched versions to ensure the security and stability of their Ethereum nodes. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability allows an attacker to crash a vulnerable Go Ethereum node using a specially crafted p2p message.
If you are running versions prior to v1.16.9, your node is vulnerable. You can check your version by running 'geth version' in the terminal.
The vulnerability can lead to Denial of Service, causing disruptions in transactions and services relying on the Ethereum network.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
