Most recent entries from all

EUVD-2026-212776

2026-10-03T14:17:19.617643+00:00

EUVD-2026-212776

fkie_cve-2025-24883

2026-10-03T14:17:19.617680+00:00

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.

GHSA-q26p-9cq4-7fc2 — Go Ethereum vulnerable to DoS via malicious p2p message

2026-10-03T14:17:19.617713+00:00

Affected: Go: github.com/ethereum/go-ethereum

### Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message.

During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1 curve. By simply sending an all-zero public key, a crash could be induced due to unexpected results from the handshake.

The issue was fixed by adding a curve point validity check in https://github.com/ethereum/go-ethereum/commit/159fb1a1db551c544978dc16a5568a4730b4abf3

### Patches

A fix has been included in geth version 1.14.13 and onwards.

### Workarounds

Unfortunately, no workaround is available.

### Credits

This issue was originally reported to Polygon Security by David Matosse (@iam-ned).

openSUSE-SU-2025:14732-1 — govulncheck-vulndb-0.0.20250204T220613-1.1 on GA media

2026-10-03T14:17:19.617750+00:00

govulncheck-vulndb-0.0.20250204T220613-1.1 on GA media

SUSE-SU-2025:0429-1 — Security update for govulncheck-vulndb

2026-10-03T14:17:19.617771+00:00

Security update for govulncheck-vulndb