VulertSecurity VulertSecurity

CVE-2020-26265: Consensus flaw in github.com/ethereum/go-ethereum

github.com/ethereum/go-ethereum Updated 02 Oct 2025

Summary

28/07/2021
CVE-2020-26265
Yes i
Moderate
5.3

CVE-2020-26265: Consensus flaw in github.com/ethereum/go-ethereum. Affects github.com/ethereum/go-ethereum versions >= 1.9.4, < 1.9.20. Fixed in 1.9.20. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

Background

The package github.com/ethereum/go-ethereum is a Go implementation of the Ethereum protocol. It provides a set of tools and libraries for interacting with the Ethereum blockchain. The package is widely used by developers and applications in the Ethereum ecosystem.

Vulnerability Detail

This vulnerability, identified as CVE-2020-26265, is a consensus flaw in github.com/ethereum/go-ethereum. It stems from an incorrect state calculation, which can lead to a consensus disagreement among nodes in the Ethereum network. Specifically, a specific set of transactions can cause users of this package to reject a canonical chain. This vulnerability can potentially disrupt the integrity and reliability of the Ethereum network.

How To Fix

Latest published version: v1.17.9 as of 23 Oct 2026 

go get github.com/ethereum/go-ethereum@v1.17.9

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

1.9.20

This is the first release that contains the fix.

go get github.com/ethereum/go-ethereum@v1.9.20

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is recommended to update to the fixed version of github.com/ethereum/go-ethereum as soon as possible.

Conclusion

In conclusion, the vulnerability identified as CVE-2020-26265 in github.com/ethereum/go-ethereum can cause a consensus disagreement in the Ethereum network. It is crucial for developers to update their usage of the package to version 1.9.20 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/ethereum/go-ethereum →

Share this vulnerability

FAQ

What is github.com/ethereum/go-ethereum?

github.com/ethereum/go-ethereum is a Go implementation of the Ethereum protocol, providing tools and libraries for interacting with the Ethereum blockchain.

This vulnerability can cause a consensus disagreement among nodes in the Ethereum network, potentially leading to the rejection of a canonical chain. It can disrupt the integrity and reliability of the Ethereum network.

To fix this vulnerability, update your usage of github.com/ethereum/go-ethereum to version 1.9.20 or later.

There is no known workaround for this vulnerability. It is recommended to update to the fixed version of github.com/ethereum/go-ethereum.

You can find more information about this vulnerability in the official CVE entry: CVE-2020-26265.

References

Related vulnerabilities

Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.

View all github.com/ethereum/go-ethereum vulnerabilities →
Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

How To Fix

Latest published version: v1.17.9 as of 23 Oct 2026 

go get github.com/ethereum/go-ethereum@v1.17.9

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

1.9.20

This is the first release that contains the fix.

go get github.com/ethereum/go-ethereum@v1.9.20

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback