Ethereum vulnerabilities
44 vulnerabilities
Known vulnerabilities in Ethereum products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.
Products
12- Go Ethereum24 vulnerabilities
- Go Ethereum16 vulnerabilities
- Cpp Ethereum7 vulnerabilities
- Aleth2 vulnerabilities
- Web3.Py2 vulnerabilities
- Blockchain1 vulnerabilities
- Eth Account1 vulnerabilities
- Ethereum1 vulnerabilities
- Ethereum Virtual Machine1 vulnerabilities
- Ethereumj1 vulnerabilities
- Py Evm1 vulnerabilities
- Rlpx1 vulnerabilities
CVE-2026-111171ethereumweb3.py+1
EPSS score0.34%
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.CVE-2018-16733ethereumgo_ethereum+1EPSS score1.21%
In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.CVE-2018-19184ethereumgo_ethereum+1EPSS score1.47%
cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode.CVE-2018-20421ethereumgo_ethereumEPSS score1.46%
Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly { mstore }" followed by a "c[0xC800000] = 0xFF" assignment.CVE-2018-18920ethereumpy-evm+2EPSS score2.93%
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."CVE-2018-15890ethereumethereumj+1EPSS score2.92%
An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.CVE-2018-12018ethereumgo_ethereum+1EPSS score4.25%
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.CVE-2021-41173ethereumgo_ethereum+2EPSS score1.24%
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading.CVE-2021-42219ethereumgo_ethereum+1EPSS score1.20%
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.CVE-2021-39137ethereumgo_ethereum+2EPSS score1.32%
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.CVE-2021-43668ubuntugolang-goleveldb+2EPSS score0.26%
Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.CVE-2015-20112ethereumrlpxEPSS score0.17%
RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.CVE-2025-24883ethereumgo-ethereum+1EPSS score0.69%
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.CVE-2020-26265ethereumgo_ethereum+2EPSS score0.92%
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to upgrade to a newer version.CVE-2020-26241ethereumgo_ethereum+2EPSS score1.23%
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.CVE-2020-26264ethereumgo_ethereum+2EPSS score1.89%
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.CVE-2020-26800ethereumalethEPSS score1.22%
A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service.CVE-2020-26240ethereumgo_ethereum+2EPSS score1.86%
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24CVE-2020-26242ethereumgo_ethereum+3EPSS score1.48%
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.CVE-2022-1930eth-accounteth-account+2EPSS score0.91%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method