# github.com/ethereum/go-ethereum (Go) vulnerabilities 25 known vulnerabilities (7 high, 10 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.17.10 (Oct 23, 2026): no advisory affects it - Newest unaffected release: v1.17.10 (Oct 23, 2026), the latest release - Releases: 249 since v0.4.1 (Jun 13, 2019) - Registry: https://pkg.go.dev/github.com/ethereum/go-ethereum - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-26315: v0.4.1 to v1.16.8 (v1.16.9 is outside it) - CVE-2026-26314: v0.4.1 to v1.16.8 (v1.16.9 is outside it) - CVE-2026-26313: v0.4.1 to v1.16.9 (v1.17.0 is outside it) - CVE-2026-22868: v0.4.1 to v1.16.7 (v1.16.8 is outside it) - CVE-2026-22862: v0.4.1 to v1.16.7 (v1.16.8 is outside it) - CVE-2025-24883: v1.14.0 to v1.14.12 (v1.14.13 is outside it) - CVE-2024-32972: v0.4.1 to v1.13.14 (v1.13.15 is outside it) - CVE-2023-42319: v0.4.1 to v1.13.4 (v1.13.5 is outside it) - CVE-2023-40591: v0.4.1 to v1.12.0 (v1.12.1 is outside it) - CVE-2022-37450: v0.4.1 to v1.10.21 (v1.10.22 is outside it) - CVE-2022-29177: v0.4.1 to v1.10.16 (v1.10.17 is outside it) - CVE-2021-42219: v0.4.1 to v1.10.9 (v1.10.10 is outside it) - CVE-2022-23328: v0.4.1 to v1.10.16 (v1.10.17 is outside it) - CVE-2022-23327: v0.4.1 to v1.10.12 (v1.10.13 is outside it) - CVE-2021-43668: v0.4.1 to v1.10.9 (v1.10.10 is outside it) - CVE-2021-41173: v0.4.1 to v1.10.8 (v1.10.9 is outside it) - CVE-2021-39137: v0.4.1 to v1.10.7 (v1.10.8 is outside it) - CVE-2020-26264: v0.4.1 to v1.9.24 (v1.9.25 is outside it) - CVE-2020-26265: v1.9.4 to v1.9.19 (v1.9.20 is outside it) - CVE-2020-26240: v0.4.1 to v1.9.23 (v1.9.24 is outside it) - CVE-2020-26241: v1.9.7 to v1.9.16 (v1.9.17 is outside it) - CVE-2020-26242: v1.9.16 to v1.9.17 (v1.9.18 is outside it) - CVE-2018-19184: v0.4.1 to v1.8.13 (v1.8.14 is outside it) - CVE-2018-16733: v0.4.1 to v1.8.13 (v1.8.14 is outside it) - CVE-2018-12018: v0.4.1 to v1.8.10 (v1.8.11 is outside it) ## Advisories (25) ### [CVE-2026-26315](https://cve.now/CVE-2026-26315): Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake - Severity: Medium 6.9 - Published: Feb 19, 2026 - Affected: fixed in 1.16.9. - Fixed in v1.16.9 (released Feb 17, 2026, 2 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2026-26314](https://cve.now/CVE-2026-26314): Go Ethereum affected by DoS via malicious p2p message - Severity: High 8.7 - Published: Feb 19, 2026 - Affected: fixed in 1.16.9. - Fixed in v1.16.9 (released Feb 17, 2026, 2 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2026-26313](https://cve.now/CVE-2026-26313): Go Ethereum affected by DoS via malicious p2p message - Severity: Medium 6.9 - Published: Feb 19, 2026 - Affected: fixed in 1.17.0. - Fixed in v1.17.0 (released Feb 17, 2026, 2 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2026-22868](https://cve.now/CVE-2026-22868): go-ethereum has a DoS via malicious p2p message - Severity: High 7.1 - Published: Jan 13, 2026 - Affected: fixed in 1.16.8. - Fixed in v1.16.8 (released Jan 13, 2026, the day of disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2026-22862](https://cve.now/CVE-2026-22862): go-ethereum has a DoS via malicious p2p message - Severity: High 7.1 - Published: Jan 13, 2026 - Affected: fixed in 1.16.8. - Fixed in v1.16.8 (released Jan 13, 2026, the day of disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2025-24883](https://cve.now/CVE-2025-24883): go-ethereum has a DoS via malicious p2p message - Severity: High 8.7 - Published: Jan 30, 2025 - Affected: from 1.14.0, fixed in 1.14.13. - Fixed in v1.14.13 (released Jan 30, 2025, the day of disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2024-32972](https://cve.now/CVE-2024-32972): go-ethereum denial of service via malicious p2p message - Severity: High 7.5 - Published: May 6, 2024 - Affected: fixed in 1.13.15. - Fixed in v1.13.15 (released Apr 17, 2024, 19 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2023-42319](https://cve.now/CVE-2023-42319): Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory… - Severity: High 7.5 - Published: Oct 18, 2023 - Affected: through 1.13.4. - Fixed in v1.13.5 (released Nov 14, 2023, 27 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2023-40591](https://cve.now/CVE-2023-40591): Denial of service via malicious p2p message in go-ethereum - Severity: High 7.5 - Published: Sep 6, 2023 - Affected: fixed in 1.12.1-stable; fixed in 1.12.1. - Fixed in v1.12.1 (released Aug 10, 2023, 27 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2022-37450](https://cve.now/CVE-2022-37450): Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a… - Severity: Unrated - Published: Aug 5, 2022 - Affected: through 1.10.21. - Fixed in v1.10.22 (released Aug 22, 2022, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2022-29177](https://cve.now/CVE-2022-29177): DoS via malicious p2p message in Go-Ethereum - Severity: Medium 5.9 - Published: May 20, 2022 - Affected: fixed in 1.10.17. - Fixed in v1.10.17 (released Mar 29, 2022, 52 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2021-42219](https://cve.now/CVE-2021-42219): Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive… - Severity: Unrated - Published: Mar 16, 2022 - Affected: through 1.10.9. - Fixed in v1.10.10 (released Oct 15, 2021, 152 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2022-23328](https://cve.now/CVE-2022-23328): A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one… - Severity: Unrated - Published: Mar 4, 2022 - Affected: through 1.10.16. - Fixed in v1.10.17 (released Mar 29, 2022, 25 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2022-23327](https://cve.now/CVE-2022-23327): A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in… - Severity: Unrated - Published: Mar 4, 2022 - Affected: through 1.10.12. - Fixed in v1.10.13 (released Nov 24, 2021, 100 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2021-43668](https://cve.now/CVE-2021-43668): Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. - Severity: Unrated - Published: Nov 18, 2021 - Affected: through 1.10.9. - Fixed in v1.10.10 (released Oct 15, 2021, 34 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.10, is not affected. ### [CVE-2021-41173](https://cve.now/CVE-2021-41173): DoS via maliciously crafted p2p message - Severity: Medium 5.7 - Published: Oct 26, 2021 - Affected: fixed in 1.10.9. - Fixed in v1.10.9 (released Sep 29, 2021, 27 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2021-39137](https://cve.now/CVE-2021-39137): Consensus flaw during block processing in go-ethereum - Severity: Medium 6.5 - Published: Aug 24, 2021 - Affected: from 1.10.0, fixed in 1.10.8; fixed in 1.10.8. - Fixed in v1.10.8 (released Aug 24, 2021, the day of disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2020-26264](https://cve.now/CVE-2020-26264): LES Server DoS via GetProofsV2 - Severity: Medium 6.5 - Published: Dec 11, 2020 - Affected: fixed in 1.9.25. - Fixed in v1.9.25 (released Dec 11, 2020, the day of disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2020-26265](https://cve.now/CVE-2020-26265): Consensus flaw during block processing - Severity: Medium 5.3 - Published: Dec 11, 2020 - Affected: from 1.9.4, fixed in 1.9.20. - Fixed in v1.9.20 (released Aug 25, 2020, 108 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2020-26240](https://cve.now/CVE-2020-26240): Erroneous Proof of Work calculation in geth - Severity: Medium 5.3 - Published: Nov 25, 2020 - Affected: fixed in 1.9.24. - Fixed in v1.9.24 (released Nov 12, 2020, 13 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2020-26241](https://cve.now/CVE-2020-26241): Shallow copy bug in geth - Severity: Medium 6.5 - Published: Nov 25, 2020 - Affected: from 1.9.7, fixed in 1.9.17. - Fixed in v1.9.17 (released Jul 20, 2020, 128 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2020-26242](https://cve.now/CVE-2020-26242): Denial of service in geth - Severity: Medium 6.5 - Published: Nov 25, 2020 - Affected: from 1.9.16, fixed in 1.9.18. - Fixed in v1.9.18 (released Jul 27, 2020, 121 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2018-19184](https://cve.now/CVE-2018-19184): cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode. - Severity: Unrated - Published: Nov 12, 2018 - Affected: fixed in 1.8.14. - Fixed in v1.8.14 (released Aug 22, 2018, 82 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2018-16733](https://cve.now/CVE-2018-16733): In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api\_tracer.go does not verify that the end block is after the start block. - Severity: Unrated - Published: Sep 8, 2018 - Affected: fixed in 1.8.14. - Fixed in v1.8.14 (released Aug 22, 2018, 17 days before disclosure). - The latest release, v1.17.10, is not affected. ### [CVE-2018-12018](https://cve.now/CVE-2018-12018): The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation… - Severity: Unrated - Published: Jul 5, 2018 - Affected: fixed in 1.8.11. - Fixed in v1.8.11 (released Jun 12, 2018, 23 days before disclosure). - The latest release, v1.17.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/ethereum/go-ethereum Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.