CVE-2026-22862CWE-20

go-ethereum has a DoS via malicious p2p message

High · published January 13, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

⚡ A single crafted message is all it takes to crash a vulnerable Ethereum node! This flaw could leave your blockchain operations halted like a stalled train. 🚂 Think of it like sending a single bad order to a restaurant that causes the entire kitchen to shut down — one wrong input, and chaos ensues! An attacker could send a malicious message that forcibly shuts down a vulnerable Ethereum node. This not only disrupts operations but could potentially lead to lost transactions and trust issues within your network.

Put simply

Think of it like sending a single bad order to a restaurant that causes the entire kitchen to shut down — one wrong input, and chaos ensues! This vulnerability in the go-ethereum (geth) implementation allows an attacker to craft a specific message that triggers a crash in the node's execution layer, effectively halting the node's operations.

What to do

An attacker could send a malicious message that forcibly shuts down a vulnerable Ethereum node. This not only disrupts operations but could potentially lead to lost transactions and trust issues within your network. To remediate this vulnerability, update your go-ethereum node to version 1.16.8 immediately. Regularly monitor your nodes for unusual messages and consider implementing additional logging to capture any suspicious activity. You've got this! With a quick update, you can keep your Ethereum nodes secure and running smoothly! 🛡️

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00727 · 53.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-01-13T20:27Z
EPSS history
Timeline
  • 13 JAN 20:27Z
    go-ethereum has a DoS via malicious p2p message
    cvelistv5