https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T21:27:03.629230+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-188806 EUVD-2026-188806 2026-10-18T21:27:03.633344+00:00 EUVD-2026-188806 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40591 fkie_cve-2023-40591 2026-10-18T21:27:03.633383+00:00

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-ppjg-v974-84cm GHSA-ppjg-v974-84cm — Go-Ethereum vulnerable to denial of service via malicious p2p message 2026-10-18T21:27:03.633429+00:00

Affected: Go: github.com/ethereum/go-ethereum

### Impact

A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.

### Details

The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.

### Patches

The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards.

Fixed by https://github.com/ethereum/go-ethereum/pull/27887

### Workarounds

No known workarounds.

### Credits

This bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org).

### References

 https://cve.radiocsirt.org/vuln/gsd-2023-40591 gsd-2023-40591 2026-10-18T21:27:03.633493+00:00 gsd-2023-40591