Moderate severityNVD Advisory· Published Dec 11, 2020· Updated Aug 4, 2024
LES Server DoS via GetProofsV2
CVE-2020-26264
Description
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ethereum/go-ethereumGo | < 1.9.25 | 1.9.25 |
Affected products
2- Range: < 1.9.25
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-r33q-22hv-j29qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-26264ghsaADVISORY
- github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46ghsax_refsource_MISCWEB
- github.com/ethereum/go-ethereum/pull/21896ghsax_refsource_MISCWEB
- github.com/ethereum/go-ethereum/releases/tag/v1.9.25ghsax_refsource_MISCWEB
- github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2021-0063ghsaWEB
News mentions
0No linked articles in our index yet.