Technology · Go

github.com/ethereum/go-ethereum (Go) vulnerabilities

Updated 27 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 27 vulnerabilities in github.com/ethereum/go-ethereum (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26313, was published on 24 February 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

About github.com/ethereum/go-ethereum (Go)

Go implementation of the Ethereum protocol for blockchain networks.

Homepage

Latest github.com/ethereum/go-ethereum (Go) vulnerabilities

CVE-2026-26313: GO-2026-4508 - Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.6%24 Feb 2026
CVE-2026-26315: GO-2026-4511 - Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.5%24 Feb 2026
CVE-2026-26314: GO-2026-4507 - Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.8%24 Feb 2026
CVE-2026-22862: GO-2026-4315 - DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.7%23 Jan 2026
CVE-2026-22868: GO-2026-4314 - High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.6%23 Jan 2026
CVE-2025-24883: GO-2025-3436 - Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.7%4 Feb 2025
CVE-2018-16733: GO-2022-0871 - Go Ethereum Improper Input Validation in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.2%21 Aug 2024
CVE-2018-19184: GO-2022-0814 - Go Ethereum Denial of Service in github.com/ethereum/go-ethereumlowCVSS 3EPSS 1.5%21 Aug 2024
CVE-2020-26241: GO-2022-0771 - Shallow copy bug in geth in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.2%21 Aug 2024
CVE-2020-26240: GO-2022-0775 - Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.9%21 Aug 2024
CVE-2022-29177: GO-2022-0456 - DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.1%21 Aug 2024
GO-2022-0392 - Denial of service in go-ethereum due to in github.com/ethereum/go-ethereuminfo21 Aug 2024
CVE-2024-32972: GO-2024-2819 - Denial of Service in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 0.9%8 May 2024
CVE-2023-40591: GO-2023-2046 - Unbounded memory consumption in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.1%25 Oct 2023
CVE-2023-42319: go-ethereum vulnerable to denial of service via crafted GraphQL querylowCVSS 3.1EPSS 0.9%18 Oct 2023
CVE-2022-37450: Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blockslowCVSS 3.1EPSS 1.2%6 Aug 2022
CVE-2021-41173: GO-2022-0256 - Panic via maliciously crafted message in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.2%15 Jul 2022
CVE-2021-39137: GO-2022-0254 - Consensus flaw during block processing in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.3%15 Jul 2022
CVE-2021-42219: Denial of service in go-ethereumlowCVSS 3.1EPSS 1.2%18 Mar 2022
CVE-2022-23327: Go-Ethereum denial of service via mempool transaction floodhighCVSS 7.5EPSS 1.4%5 Mar 2022
CVE-2022-23328: Denial of Service in Go-EthereumlowCVSS 3.1EPSS 1.4%5 Mar 2022
CVE-2021-43668: Denial of Service in Go-EthereumlowCVSS 3.1EPSS 0.3%23 Nov 2021
CVE-2020-26242: GO-2021-0103 - Denial of service in github.com/holiman/uint256lowCVSS 3.1EPSS 1.5%28 Jul 2021
CVE-2020-26265: GO-2021-0105 - Consensus flaw in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 0.9%28 Jul 2021
Denial of service in go-ethereum due toinfo29 Jun 2021

Most severe github.com/ethereum/go-ethereum (Go) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2022-23327: Go-Ethereum denial of service via mempool transaction floodhighCVSS 7.5EPSS 1.4%5 Mar 2022
CVE-2026-26314: GO-2026-4507 - Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.8%24 Feb 2026
CVE-2026-22862: GO-2026-4315 - DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.7%23 Jan 2026
CVE-2025-24883: GO-2025-3436 - Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.7%4 Feb 2025
CVE-2026-22868: GO-2026-4314 - High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.6%23 Jan 2026
CVE-2026-26313: GO-2026-4508 - Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.6%24 Feb 2026
CVE-2026-26315: GO-2026-4511 - Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereummediumCVSS 4EPSS 0.5%24 Feb 2026
CVE-2020-26264: GO-2021-0063 - Nil pointer dereference via malicious RPC message in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.9%14 Apr 2021
CVE-2020-26240: GO-2022-0775 - Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereumlowCVSS 3.1EPSS 1.9%21 Aug 2024
CVE-2020-26242: GO-2021-0103 - Denial of service in github.com/holiman/uint256lowCVSS 3.1EPSS 1.5%28 Jul 2021

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
29 Jun 2026		0	0
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/github-com-ethereum-go-ethereum.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "github.com/ethereum/go-ethereum (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-ethereum-go-ethereum, 27 September 2026.