CVE-2026-26315: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
Impact
Through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key.
Patches
The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. We recommend rotating the node key after applying the upgrade, which can be done by removing the file <datadir>/geth/nodekey before starting Geth.
Credit
The issue was reported as a public pull request to go-ethereum by @fengjian.
Other sources
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file <datadir>/geth/nodekey before starting Geth.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26315?
CVE-2026-26315 has a high severity rating due to its potential to compromise the security of the ECIES public key.
How do I fix CVE-2026-26315?
To resolve CVE-2026-26315, upgrade to Go Ethereum versions v1.16.9 or v1.17.0 or later.
What impact does CVE-2026-26315 have on network security?
CVE-2026-26315 could allow attackers to extract sensitive information from the p2p node key, posing a significant risk to network security.
Which versions of Go Ethereum are affected by CVE-2026-26315?
CVE-2026-26315 affects all Go Ethereum versions up to and including v1.16.8.
Is there a patch available for CVE-2026-26315?
Yes, the issue has been patched in the releases v1.16.9 and v1.17.0 of Go Ethereum.