CVE-2020-26265: Consensus flaw during block processing in github.com/ethereum/go-ethereum
Summary
CVE-2020-26265: Consensus flaw in github.com/ethereum/go-ethereum. Affects github.com/ethereum/go-ethereum versions >= 1.9.4, < 1.9.20. Fixed in 1.9.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/ethereum/go-ethereum, which is written in Go. It is an implementation of the Ethereum protocol and provides the necessary tools and libraries for interacting with the Ethereum blockchain. The package allows users to create and manage Ethereum accounts, send and receive transactions, and participate in the consensus mechanism of the Ethereum network. However, a vulnerability has been discovered in the package that could lead to a chain split and refusal to accept the canonical chain.
Vulnerability Detail
The vulnerability, identified as CVE-2020-26265, is a consensus vulnerability in Geth (the Go Ethereum client). It can be triggered by a specific sequence of transactions, resulting in a consensus failure. The flaw was reported by John Youngseok Yang from the Software Platform Lab. The vulnerability allows an attacker to manipulate the balance of an Ethereum account, leading to incorrect results and potential chain splits. The root cause of the vulnerability was a change in the semantics of the 'createObject' function, which caused a non-nil object to be returned even if the account had been destructed. This incorrect return value resulted in the new object inheriting the old balance. The vulnerability was fixed in Geth version 1.9.20 'Paragade'.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.20
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.9.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of Geth.
Conclusion
In conclusion, the vulnerability CVE-2020-26265 in github.com/ethereum/go-ethereum can lead to a consensus failure and chain split in Geth. Users are advised to update to Geth version 1.9.20 or later to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability can cause a chain split, where vulnerable versions of Geth refuse to accept the canonical chain. This can lead to inconsistencies in the Ethereum network and potential disruption of services relying on the Ethereum blockchain.
The vulnerability was discovered by John Youngseok Yang from the Software Platform Lab and reported to the Ethereum security team.
The root cause of the vulnerability was a change in the semantics of the 'createObject' function in Geth, which resulted in incorrect return values and balance inheritance.
Yes, the vulnerability has been fixed in Geth version 1.9.20 'Paragade'. Users are advised to update their installations to the latest version to mitigate the risk.
For more information, you can open an issue in the go-ethereum GitHub repository or email the Ethereum security team at security@ethereum.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
