CVE-2026-26313: Go Ethereum affected by DoS via malicious p2p message
Impact
An attacker can cause high memory usage by sending a specially-crafted p2p message. More details to be released later.
Patches
The issue is resolved in the v1.17.0 release.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by @revofusion
Other sources
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26313?
CVE-2026-26313 is classified as a denial of service (DoS) vulnerability due to high memory usage risks.
How do I fix CVE-2026-26313?
To fix CVE-2026-26313, update to Go Ethereum version 1.17.0 or later.
What impact does CVE-2026-26313 have on systems?
CVE-2026-26313 can cause significant memory usage leading to potential system instability.
Which versions of Go Ethereum are affected by CVE-2026-26313?
Versions prior to Go Ethereum v1.17.0 are affected by CVE-2026-26313.
How was CVE-2026-26313 identified?
CVE-2026-26313 was reported by a member of the Ethereum community concerning a flaw in the handling of malicious p2p messages.