CVE-2020-26242

Denial of service in geth

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.

Affected

ethereum · go-ethereum

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

1.48% chance of exploitation in the next 30 days, 74th percentile

Published

2020-11-25

Updated

2024-08-04

Proof-of-concept exploits (1)

• advisories/GHSA-jm5c-rv3w-w83m

Security advisories

• https://blog.ethereum.org/2020/11/12/geth_security_release
• ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m

References

• CVE Record
• NVD entry