CVE-2020-26240 json
Erroneous Proof of Work calculation in geth
published 2020-11-25 5 y ago modified 2026-09-10 1 mo ago also GHSA-v592-xf75-856p , GO-2022-0775 , EUVD-2021-1406
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
Patch / fix
- go github.com/ethereum/go-ethereum 1.9.24
- ethereum go_ethereum 1.9.24
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1
opensuse advisories openSUSE-SU-2025:15424-1
- github.com/ethereum/go-ethereum@d990df9 commit
- github.com/ethereum/go-ethereum#21793 pull request
Exploit prediction
1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/ethereum/go-ethereum | <1.9.24 |
1.9.24 |
Affected products
- ethereum go-ethereum
Classification
- Weakness
-
- CWE-682 Incorrect Calculation
References
-
github.com
/ethereum/go-ethereum/pull/21793
web, patch, third-party-advisory
-
github.com
/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
web, patch, third-party-advisory
-
blog.ethereum.org
/2020/11/12/geth_security_release/
vendor-advisory
-
github.com
/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26240
advisory
-
blog.ethereum.org
/2020/11/12/geth_security_release
web
-
github.com
/ethereum/go-ethereum
package
Sources
- CVE List CVE-2020-26240
- GitHub Advisory GHSA-v592-xf75-856p
- NVD CVE-2020-26240
- OSV GO-2022-0775
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.