CVE-2026-26315: fallo de gravedad media en ethereum go-ethereum
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.5%
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
ethereum · go-ethereumCVEs relacionadas — ethereum go-ethereum
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-26264MEDIUMLES Server DoS via GetProofsV2EPSS 1.9%CVE-2020-26240MEDIUMErroneous Proof of Work calculation in gethEPSS 1.9%CVE-2020-26242MEDIUMDenial of service in gethEPSS 1.5%CVE-2021-39137MEDIUMConsensus flaw during block processing in go-ethereumEPSS 1.3%CVE-2021-41173MEDIUMDoS via maliciously crafted p2p messageEPSS 1.2%CVE-2020-26241MEDIUMShallow copy bug in gethEPSS 1.2%