CVE-2026-22868CWE-20

go-ethereum has a DoS via malicious p2p message

High · published January 13, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

⚡ A cleverly crafted message can unexpectedly force your Ethereum node to crash! ⛔ Imagine a restaurant where a customer sends an order so confusing that the kitchen just shuts down entirely — that’s what this vulnerability does to your go-ethereum node. It's like throwing a wrench in the works when everything was running smoothly! An attacker could send a malicious message that causes the node to crash, disrupting operations and potentially affecting connected services. This could lead to downtime and loss of service availability, which is absolutely devastating for anyone relying on the Ethereum network!

Put simply

Imagine a restaurant where a customer sends an order so confusing that the kitchen just shuts down entirely — that’s what this vulnerability does to your go-ethereum node. It's like throwing a wrench in the works when everything was running smoothly! This vulnerability in go-ethereum (geth) allows an attacker to force a node to shutdown by sending a specially crafted message, effectively crashing it without needing any prior access.

What to do

An attacker could send a malicious message that causes the node to crash, disrupting operations and potentially affecting connected services. This could lead to downtime and loss of service availability, which is absolutely devastating for anyone relying on the Ethereum network! Upgrade your go-ethereum node to version 1.16.8 immediately to patch this vulnerability. Regularly monitor your nodes and consider implementing additional validation on incoming messages to bolster defenses. You’ve got this! By taking action, you’re on your way to becoming a security hero in the Ethereum ecosystem! 🛡️

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00625 · 49.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-01-13T20:27Z
EPSS history
Timeline
  • 13 JAN 20:27Z
    go-ethereum has a DoS via malicious p2p message
    cvelistv5