CVE-2026-26315
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Feb 19, 2026
CISA due date
—
The record
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/ethereum/go-ethereum | 0 | 1.16.9 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4511 Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in… Same vulnerability
- GO-2026-4507 Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum Also affects github.com/ethereum/go-ethereum
- GO-2026-4508 Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum Also affects github.com/ethereum/go-ethereum
- CVE-2026-26314 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Also affects github.com/ethereum/go-ethereum
- CVE-2026-26313 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Also affects github.com/ethereum/go-ethereum
- GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum Also affects github.com/ethereum/go-ethereum
- GO-2026-4315 DoS via malicious p2p message affecting a vulnerable node in… Also affects github.com/ethereum/go-ethereum
- CVE-2026-22862 go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node Also affects github.com/ethereum/go-ethereum