Skip to content
Fencer Vulns
medium 6.5

CVE-2020-26242 json

Denial of service in geth

published 2020-11-25 5 y ago modified 2026-07-08 4 mo ago also GHSA-jm5c-rv3w-w83m , GO-2021-0103 , EUVD-2021-1345

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.

Patch / fix

  • go github.com/ethereum/go-ethereum 1.9.18
  • go github.com/holiman/uint256 1.1.1
  • ethereum go_ethereum 1.9.18

Exploit prediction

1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/ethereum/go-ethereum
>=1.9.16, <1.9.18
1.9.18
go github.com/holiman/uint256
>=0.1.0, <1.1.1
1.1.1

Affected products

  • ethereum go-ethereum

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-191 Integer Underflow (Wrap or Wraparound)
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.