7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22862

CVE-2026-22862: go-ethereum has a DoS via malicious p2p message

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22862

CVE-2026-22862:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ethereum/go-ethereum	go	<= 1.16.7	1.16.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a remote attacker to cause a Denial of Service (DoS) on a go-ethereum node. The analysis of the patch reveals two distinct attack vectors that were fixed.

First, the primary DoS vector involved the processing of blob transactions. The functions validateBlobSidecarLegacy and validateBlobSidecarOsaka perform computationally expensive KZG proof verifications. Prior to the patch, if this verification failed, a generic error was returned. The calling function, TxFetcher.Enqueue, which handles incoming transactions from peers, would simply reject the single invalid transaction but would continue to process other transactions from the same potentially malicious peer. An attacker could exploit this by repeatedly sending transactions with invalid proofs, forcing the node to waste significant CPU resources on verification, leading to a DoS. The patch addresses this by introducing a specific error, ErrKZGVerificationError, and modifying TxFetcher.Enqueue to detect this error, immediately stop processing transactions from the offending peer, and disconnect them.

Second, a separate issue was identified in the PrivateKey.Decrypt function, which is used for decrypting p2p messages. An incorrect length check on the incoming encrypted data could be exploited by a specially crafted message. This could lead to a panic (e.g., an out-of-bounds read) when the malformed message is processed, causing the node to crash. The patch corrects the length check to properly validate the incoming message size, preventing the crash.

In summary, the identified vulnerable functions are those that either perform the expensive computations that can be abused (validateBlobSidecarLegacy, validateBlobSidecarOsaka), the function that orchestrates the processing of peer messages without proper safeguards (TxFetcher.Enqueue), or the function that could be made to crash the node with a malformed message (PrivateKey.Decrypt).

Vulnerable functions

TxFetcher.Enqueue

eth/fetcher/tx_fetcher.go

This function processes incoming transactions from peers. Before the patch, it did not properly handle computationally expensive verification failures for blob transactions. An attacker could send multiple transactions with invalid KZG proofs, causing a Denial of Service by consuming excessive CPU resources. The patch introduces a mechanism to detect this specific failure, stop processing further transactions from the malicious peer, and disconnect them.

PrivateKey.Decrypt

crypto/ecies/ecies.go

This function decrypts ECIES encrypted messages. It contained an incorrect length validation check. A specially crafted short message could bypass the check and cause an out-of-bounds read or other panic later in the function, leading to a node crash and Denial of Service.

validateBlobSidecarLegacy

core/txpool/validation.go

This function is responsible for validating blob transactions by performing KZG proof verification, which is a computationally expensive operation. The original implementation returned a generic error, which was not handled in a way to prevent abuse. The function was modified to return a specific error (`ErrKZGVerificationError`) that allows the caller (`TxFetcher.Enqueue`) to identify and penalize a peer sending invalid data, thus mitigating a DoS vector.

validateBlobSidecarOsaka

core/txpool/validation.go

Similar to `validateBlobSidecarLegacy`, this function performs expensive KZG proof verifications for a different type of blob transaction. It was vulnerable in the same way, where a failure would not be specifically handled to prevent a DoS attack. The patch wraps the returned error to be more specific, enabling the caller to take defensive actions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.