Medium severity6.5NVD Advisory· Published Dec 11, 2020· Updated Jun 17, 2026
CVE-2020-26264
CVE-2020-26264
Description
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ethereum/go-ethereumGo | < 1.9.25 | 1.9.25 |
Affected products
3cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*range: <1.9.25
- (no CPE)range: < 1.9.25
Patches
Vulnerability mechanics
References
7- github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46nvdPatchThird Party AdvisoryWEB
- github.com/ethereum/go-ethereum/pull/21896nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-r33q-22hv-j29qghsaADVISORY
- github.com/ethereum/go-ethereum/releases/tag/v1.9.25nvdThird Party AdvisoryWEB
- github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-26264ghsaADVISORY
- pkg.go.dev/vuln/GO-2021-0063ghsaWEB
News mentions
0No linked articles in our index yet.