CVE-2026-26313

Received Received - Intake

Memory Exhaustion Vulnerability in go-ethereum p2p Messaging

Publication date: 2026-02-19

Last updated on: 2026-02-23

Assigner: GitHub, Inc.

Description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-19

Last Modified

2026-02-23

Generated

2026-07-06

AI Q&A

2026-02-19

EPSS Evaluated

2026-07-05

NVD

CVE-2026-26313

Affected Vendors & Products

Vendor	Product	Version / Range
ethereum	go_ethereum	to 1.17.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

The vulnerability exists in go-ethereum (geth), a golang implementation of the Ethereum protocol. Before version 1.17.0, an attacker could send a specially-crafted peer-to-peer (p2p) message that causes the software to use a high amount of memory.

This issue was fixed in version 1.17.0 of go-ethereum.

Impact Analysis

This vulnerability can lead to excessive memory consumption on systems running vulnerable versions of go-ethereum. An attacker exploiting this could degrade system performance or potentially cause denial of service by exhausting available memory resources.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your go-ethereum (geth) software to version 1.17.0 or later, where the issue has been resolved.

Hi! I’m here to help you understand CVE-2026-26313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70