High severity7.5NVD Advisory· Published Feb 19, 2026· Updated Jun 17, 2026
CVE-2026-26315
CVE-2026-26315
Description
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file /geth/nodekey before starting Geth.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ethereum/go-ethereumGo | < 1.16.9 | 1.16.9 |
Affected products
5cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*range: <1.16.9
- (no CPE)range: < 1.16.9
- ghsa-coords3 versionspkg:golang/github.com/ethereum/go-ethereumpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 1.16.9+ 2 more
- (no CPE)range: < 1.16.9
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-m6j8-rg6r-7mv8ghsaADVISORY
- github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-26315ghsaADVISORY
- github.com/ethereum/go-ethereum/commit/46bee92f9e64c0a06a12586a5d21cffc49d1ba8eghsaWEB
- github.com/ethereum/go-ethereum/pull/33669ghsaWEB
- github.com/ethereum/go-ethereum/releases/tag/v1.16.9ghsaWEB
- pkg.go.dev/vuln/GO-2026-4511ghsaWEB
News mentions
0No linked articles in our index yet.