Denial of Service in go-ethereum (geth) via Crafted Message

Publication date: 2026-01-13

Last updated on: 2026-01-13

Assigner: GitHub, Inc.

Description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-01-13

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-04

NVD

CVE-2026-22862

Affected Vendors & Products

Vendor	Product	Version / Range
ethereum	go-ethereum	to 1.16.8 (exc)
ethereum	go-ethereum	to 1.16.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in go-ethereum (geth) allows a malicious actor to force a vulnerable node to shutdown or crash by sending a specially crafted message. It affects the execution layer implementation of the Ethereum protocol and is fixed in version 1.16.8.

Impact Analysis

The vulnerability can cause a node running the affected go-ethereum software to unexpectedly shutdown or crash, potentially disrupting Ethereum network operations, causing denial of service, and impacting availability of services relying on the node.

Mitigation Strategies

Upgrade the go-ethereum (geth) software to version 1.16.8 or later, as this version contains the fix for the vulnerability that allows a node to be forced to shutdown or crash by a specially crafted message.

Hi! I’m here to help you understand CVE-2026-22862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70