CVE-2026-26315CWE-203

Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

Medium · published February 19, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00595 · 47.7th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-02-19T21:22Z
EPSS history
Timeline
  • 19 FEB 21:22Z
    Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
    cvelistv5