Read the docs
TI-2020-16061 Aliases CVE-2020-26240GHSA-v592-xf75-856p

Erroneous Proof of Work calculation in geth

Priority LOW 37CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24

Why it matters now

EPSS 0.01863 79th percentileScored 2026-11-07
Fix Fixed go-ethereum (ethereum): 1.9.24github.com/ethereum/go-ethereum (Go): 1.9.24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ethereumgo-ethereumbefore 1.9.241.9.24Patch availableCNA
—github.com/ethereum/go-ethereum (Go)before 1.9.241.9.24Patch availableGHSA-v592-xf75-856p
  • go-ethereum Vendorethereum Affected before 1.9.24 Fixed in 1.9.24 Patch available CNA
  • github.com/ethereum/go-ethereum (Go) Vendor— Affected before 1.9.24 Fixed in 1.9.24 Patch available GHSA-v592-xf75-856p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*before 1.9.24Vulnerableethereum
  • cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:* Versions before 1.9.24 Vulnerable ·ethereum

Remediation

  • Fix · CNA go-ethereum (ethereum) Fixed in 1.9.24
  • Fix · GHSA-v592-xf75-856p github.com/ethereum/go-ethereum (Go) Fixed in 1.9.24 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26240
  2. 2026-10-03 Alias added: GHSA-v592-xf75-856p

References

Patch 2

Advisory 3

Other 2

  • TI-2023-22561 Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote… CVSS 3.1HIGH 7.5
  • TI-2026-21270 Go Ethereum affected by DoS via malicious p2p message CVSS 4.0HIGH 8.7
  • TI-2023-21389 Denial of service via malicious p2p message in go-ethereum CVSS 3.1HIGH 7.5
  • TI-2018-08612 The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka… CVSS 3.0HIGH 7.5
  • TI-2026-21271 Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake CVSS 4.0MEDIUM 6.9
  • TI-2026-21269 Go Ethereum affected by DoS via malicious p2p message CVSS 4.0MEDIUM 6.9
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences