Moderate severityNVD Advisory· Published Feb 19, 2026· Updated Feb 20, 2026
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
CVE-2026-26315
Description
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file /geth/nodekey before starting Geth.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ethereum/go-ethereumGo | < 1.16.9 | 1.16.9 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/ethereum/go-ethereumpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 1.16.9+ 1 more
- (no CPE)range: < 1.16.9
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- Range: < 1.16.9
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-m6j8-rg6r-7mv8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26315ghsaADVISORY
- github.com/ethereum/go-ethereum/commit/46bee92f9e64c0a06a12586a5d21cffc49d1ba8eghsaWEB
- github.com/ethereum/go-ethereum/pull/33669ghsaWEB
- github.com/ethereum/go-ethereum/releases/tag/v1.16.9ghsaWEB
- github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8ghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2026-4511ghsaWEB
News mentions
0No linked articles in our index yet.