CVE-2021-39137: Consensus flaw during block processing in go-ethereum
Summary
CVE-2021-39137: Ethereum Contains Consensus Flaw During Block Processing. Affects github.com/ethereum/go-ethereum versions >= 1.10.0, < 1.10.8. Fixed in 1.10.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
go-ethereum is an open-source implementation of the Ethereum protocol written in Go. It is widely used as a client for interacting with the Ethereum network. The vulnerability identified as CVE-2021-39137 affects all versions of go-ethereum that support the London hard fork. This vulnerability can lead to a consensus error, causing a node to reject the canonical chain and resulting in a chain split.
Vulnerability Detail
The vulnerability arises from a memory-corruption bug within the Ethereum Virtual Machine (EVM) in go-ethereum. When processing a maliciously crafted transaction, vulnerable nodes can obtain a different stateRoot, leading to a chain split. This can have significant ramifications for the Ethereum network, as it can result in a minority chain split. The vulnerability has a CVSS score of 6.5.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.8
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.10.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The recommended course of action is to update go-ethereum to the patched version.
Conclusion
The vulnerability identified as CVE-2021-39137 in go-ethereum can lead to a consensus error and chain split. Users are advised to update their go-ethereum installation to version 1.10.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
go-ethereum is an open-source implementation of the Ethereum protocol written in Go. It is widely used as a client for interacting with the Ethereum network.
The vulnerability can cause a consensus error and result in a chain split, leading to potential disruptions in the Ethereum network.
To fix this vulnerability, update your go-ethereum installation to version 1.10.8 or later. Apply the patch provided in the advisory or update to the latest version.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the recommended solution.
The vulnerability was discovered by @guidovranken during an audit of the Telos EVM and reported via bounty@ethereum.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
