Vulnerabilities

TI-2026-74955 CVE-2026-111171

Server-side request forgery in Web3.py CCIP Read URL validation

MEDIUM 61

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00341 Published 2026-10-15 No fix listed CWE-918

TI-2026-28903 CVE-2026-40072 · GHSA-5hr4-253g-cpx2

web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

MEDIUM 43

web3.py allows you to interact with the Ethereum blockchain using Python.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00237 Published 2026-04-09 Fixed in 7.15.0, 8.0.0b2 CWE-918

TI-2026-21271 CVE-2026-26315 · GHSA-m6j8-rg6r-7mv8

Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

LOW 37

go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00507 Published 2026-02-19 Fixed in 1.16.9 CWE-203

TI-2026-21270 CVE-2026-26314 · GHSA-2gjw-fg97-vg3r

Go Ethereum affected by DoS via malicious p2p message

MEDIUM 45

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00659 Published 2026-02-19 Fixed in 1.16.9 CWE-20

TI-2026-21269 CVE-2026-26313 · GHSA-689v-6xwf-5jf3

Go Ethereum affected by DoS via malicious p2p message

LOW 37

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00651 Published 2026-02-19 Fixed in 1.17.0 CWE-770

TI-2026-18360 CVE-2026-22868 · GHSA-mq3p-rrmp-79jg

go-ethereum has a DoS via malicious p2p message

LOW 32

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00625 Published 2026-01-13 Fixed in 1.16.8 CWE-20

TI-2026-18354 CVE-2026-22862 · GHSA-mr7q-c9w9-wh4h

go-ethereum has a DoS via malicious p2p message

LOW 32

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00727 Published 2026-01-13 Fixed in 1.16.8 CWE-20

TI-2015-08087 CVE-2015-20112 · GHSA-gv8j-3j98-685g

RLPx 5 has two CTR streams based on the same key, IV, and nonce.

LOW 16

RLPx 5 has two CTR streams based on the same key, IV, and nonce.

CVSS 3.1LOW 3.4 Adjacent network No auth No interaction EPSS 0.00166 Published 2025-06-29 No fix listed CWE-325

TI-2025-18585 CVE-2025-24883 · GHSA-q26p-9cq4-7fc2

go-ethereum has a DoS via malicious p2p message

MEDIUM 45

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00689 Published 2025-01-30 Fixed in 1.14.13 CWE-248

TI-2024-21838 CVE-2024-32972 · GHSA-4xc9-8hmq-j652

go-ethereum denial of service via malicious p2p message

LOW 34

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00846 Published 2024-05-06 Fixed in 1.13.15 CWE-400

TI-2023-22561 CVE-2023-42319 · GHSA-v9jh-j8px-98vq

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote…

HIGH 72

Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01177 Published 2023-10-18 No fix listed CWE-400

TI-2023-18728 CVE-2023-36980 · GHSA-c2rp-g99g-j6gv

An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out…

LOW 30

An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00421 Published 2023-09-11 No fix listed CWE-682

TI-2023-21389 CVE-2023-40591 · GHSA-ppjg-v974-84cm

Denial of service via malicious p2p message in go-ethereum

MEDIUM 41

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01121 Published 2023-09-06 Fixed in 1.12.1-stable CWE-400

TI-2022-01789 CVE-2022-1930 · GHSA-v65g-f3cj-fjp4

ReDoS in eth-account encode_structured_data function

LOW 35

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00939 Published 2022-08-22 Fixed in 0.5.9 CWE-1333

TI-2022-17504 CVE-2022-37450 · GHSA-rqmg-hrg4-fm69

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining…

LOW 29

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Risk…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01271 Published 2022-08-05 No fix listed

TI-2022-11720 CVE-2022-29177 · GHSA-wjxw-gh3m-7pm5

DoS via malicious p2p message in Go-Ethereum

LOW 29

Go Ethereum is the official Golang implementation of the Ethereum protocol.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01155 Published 2022-05-20 Fixed in 1.10.17 CWE-400

TI-2021-18677 CVE-2021-42219 · GHSA-vrcc-g6vj-mh5w

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a…

LOW 35

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01197 Published 2022-03-16 No fix listed CWE-400

TI-2022-07441 CVE-2022-23328 · GHSA-vmf7-hmh6-vv57

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending…

LOW 36

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, whic…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01373 Published 2022-03-04 No fix listed CWE-400

TI-2022-07440 CVE-2022-23327 · GHSA-pvx3-gm3c-gmpr

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send…

LOW 36

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01373 Published 2022-03-04 No fix listed CWE-400

TI-2021-19507 CVE-2021-43668 · GHSA-5m8f-chrv-7rw5

Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages…

LOW 24

Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00259 Published 2021-11-18 No fix listed CWE-476

TI-2021-18012 CVE-2021-41173 · GHSA-59hh-656j-3p7v

DoS via maliciously crafted p2p message

LOW 28

Go Ethereum is the official Golang implementation of the Ethereum protocol.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01242 Published 2021-10-26 Fixed in 1.10.9 CWE-20

TI-2021-16524 CVE-2021-39137 · GHSA-9856-9gg9-qcmq

Consensus flaw during block processing in go-ethereum

LOW 36

go-ethereum is the official Go implementation of the Ethereum protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01325 Published 2021-08-24 Fixed in 1.10.8 CWE-436

TI-2020-16267 CVE-2020-26800 · GHSA-8pw5-pwp5-8mcx

A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a…

LOW 27

A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01218 Published 2021-01-11 No fix listed CWE-787

TI-2020-16085 CVE-2020-26264 · GHSA-r33q-22hv-j29q

LES Server DoS via GetProofsV2

LOW 33

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01886 Published 2020-12-11 Fixed in 1.9.25 CWE-400

TI-2020-16086 CVE-2020-26265 · GHSA-xw37-57qp-9mm4

Consensus flaw during block processing

LOW 26

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0092 Published 2020-12-11 Fixed in 1.9.20 CWE-682

Vulnerabilities

Filters