CVE-2020-26264: Panic in github.com/ethereum/go-ethereum
Summary
CVE-2020-26264: Panic in github.com/ethereum/go-ethereum. Affects github.com/ethereum/go-ethereum versions < 1.9.25. Fixed in 1.9.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/ethereum/go-ethereum is an implementation of the Ethereum protocol in the Go programming language. It provides a set of tools and libraries for interacting with the Ethereum blockchain. This package is widely used by developers to build decentralized applications (dApps) and other Ethereum-related projects. However, a vulnerability has been discovered in this package that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability (CVE-2020-26264) in github.com/ethereum/go-ethereum is caused by a nil pointer dereference. This means that a maliciously crafted RPC message can trigger a panic in the code, leading to a denial of service (DoS) attack. If the package is used to handle RPC messages from untrusted clients, this vulnerability can be exploited to disrupt the availability of the application or service. The impact of this vulnerability can range from temporary unavailability to a complete system crash.
How To Fix
Latest published version: v1.17.9 as of 23 Oct 2026
go get github.com/ethereum/go-ethereum@v1.17.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.25
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.9.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section as soon as possible.
Conclusion
The vulnerability (CVE-2020-26264) in github.com/ethereum/go-ethereum can be exploited through a nil pointer dereference, leading to a panic and potential denial of service. To fix this vulnerability, developers should update to version 1.9.25 or later of the package. There are no known workarounds, and it is recommended to apply the fix as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
This vulnerability can be used as a denial of service (DoS) vector, potentially leading to the unavailability or crash of the affected application or service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and the tool will analyze it for any open-source vulnerabilities, including this one.
While the details of any known exploits are not provided, it is important to update to the fixed version as soon as possible to prevent potential attacks.
Yes, this vulnerability can be exploited remotely by sending a maliciously crafted RPC message to the affected application or service.
The only effective mitigation is to update to the fixed version of github.com/ethereum/go-ethereum. It is recommended to do so as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
