VYPR
Get started
← All advisories
High severityNVD Advisory· Published Jan 30, 2025· Updated Apr 15, 2026

CVE-2025-24883

CVE-2025-24883

Description

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/ethereum/go-ethereumGo
>= 1.14.0, < 1.14.131.14.13

Patches

3
eb00f1694c92
https://github.com/ethereum/go-ethereumvia osv
fa9a2ff8687e

crypto: add IsOnCurve check (#31100)

https://github.com/ethereum/go-ethereumFelix LangeJan 30, 2025via ghsa
commit
1 file changed · +3 −0
  • crypto/crypto.go+3 −0 modified
    @@ -178,6 +178,9 @@ func UnmarshalPubkey(pub []byte) (*ecdsa.PublicKey, error) {
 	if x == nil {
 		return nil, errInvalidPubkey
 	}
+	if !S256().IsOnCurve(x, y) {
+		return nil, errInvalidPubkey
+	}
 	return &ecdsa.PublicKey{Curve: S256(), X: x, Y: y}, nil
 }
159fb1a1db55

crypto: add IsOnCurve check (#31100)

https://github.com/ethereum/go-ethereumFelix LangeJan 30, 2025via ghsa
commit
1 file changed · +3 −0
  • crypto/crypto.go+3 −0 modified
    @@ -178,6 +178,9 @@ func UnmarshalPubkey(pub []byte) (*ecdsa.PublicKey, error) {
 	if x == nil {
 		return nil, errInvalidPubkey
 	}
+	if !S256().IsOnCurve(x, y) {
+		return nil, errInvalidPubkey
+	}
 	return &ecdsa.PublicKey{Curve: S256(), X: x, Y: y}, nil
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.