CVE-2026-22868
Medium · 6.5go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message
CVSS
6.5
EPSS
0.6%
Published
Jan 13, 2026
CISA due date
—
The record
**Impact** An attacker can cause high CPU usage by sending a specially crafted p2p message. More details to be released later. **Credit** This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/ethereum/go-ethereum | 0 | 1.16.8 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260123T022811-150000.1.140.1 |
Related vulnerabilities
- GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum Same vulnerability
- GO-2026-4507 Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum Also affects github.com/ethereum/go-ethereum
- GO-2026-4508 Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum Also affects github.com/ethereum/go-ethereum
- GO-2026-4511 Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in… Also affects github.com/ethereum/go-ethereum
- CVE-2026-26314 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Also affects github.com/ethereum/go-ethereum
- CVE-2026-26315 go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Also affects github.com/ethereum/go-ethereum
- CVE-2026-26313 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Also affects github.com/ethereum/go-ethereum
- GO-2026-4315 DoS via malicious p2p message affecting a vulnerable node in… Also affects github.com/ethereum/go-ethereum