CVE-2020-26264: Denial of Service in github.com/ethereum/go-ethereum
Summary
CVE-2020-26264: Nil pointer dereference via malicious RPC message in github.com/ethereum/go-ethereum. Affects github.com/ethereum/go-ethereum versions < 1.9.25. Fixed in 1.9.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/ethereum/go-ethereum, which is written in Go. It is an implementation of the Ethereum protocol and provides a client for interacting with the Ethereum network. The package enables users to create and manage Ethereum accounts, send and receive transactions, and interact with smart contracts. The vulnerability in this package can lead to a denial of service (DoS) attack when a malicious GetProofsV2 request is sent from a connected LES client to a LES server.
Vulnerability Detail
The DoS vulnerability in github.com/ethereum/go-ethereum allows an attacker to crash a LES server by exploiting a flaw in the GetProofsV2 request handling. By sending a specially crafted malicious request, an attacker can trigger a crash in the LES server, rendering it unavailable. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level. It is important to note that this vulnerability only affects users who have explicitly enabled the les server. Disabling the les server prevents the exploit. The vulnerability has been patched in version 1.9.25 of the package.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.25
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.9.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, users can disable the les server to prevent the exploit. This can be done by modifying the configuration of the Ethereum client to exclude the les server from the enabled protocols.
Conclusion
The vulnerability in github.com/ethereum/go-ethereum can lead to a denial of service attack on a LES server. Users are advised to update their package to version 1.9.25 or later to fix the vulnerability. Alternatively, the les server can be disabled as a workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
github.com/ethereum/go-ethereum is an implementation of the Ethereum protocol in Go. It provides a client for interacting with the Ethereum network, allowing users to manage accounts, send transactions, and interact with smart contracts.
The vulnerability allows an attacker to crash a LES server by sending a malicious GetProofsV2 request. This can result in a denial of service, rendering the server unavailable.
To fix the vulnerability, update github.com/ethereum/go-ethereum to version 1.9.25 or later. Alternatively, manually apply the patch provided in the pull request https://github.com/ethereum/go-ethereum/pull/21896.
Yes, you can disable the les server to prevent the exploit. Modify the configuration of the Ethereum client to exclude the les server from the enabled protocols.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. However, it only affects users who have explicitly enabled the les server.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
