7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22868

CVE-2026-22868: go-ethereum has a DoS via malicious p2p message

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22868

CVE-2026-22868:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ethereum/go-ethereum	go	<= 1.16.7	1.16.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to cause high CPU usage by sending specially crafted p2p messages, leading to a denial-of-service. The root cause is the computationally expensive KZG verification process for blob transactions. The analysis of the patch abeb78c647e354ed922726a1d719ac7bc64a07e2 reveals the following:

Expensive Computations: The functions validateBlobSidecarLegacy and validateBlobSidecarOsaka in core/txpool/validation.go perform the heavy lifting of KZG proof verification. An attacker can craft invalid proofs that are expensive to verify, consuming significant CPU time.
Ineffective Rate Limiting: The TxFetcher.Enqueue method in eth/fetcher/tx_fetcher.go is responsible for processing transactions received from peers. Prior to the patch, it would process an entire batch of transactions from a peer without stopping, even if some transactions failed verification. This allowed an attacker to flood the node with malicious transactions.
The Fix: The patch introduces a new specific error, ErrKZGVerificationError, which is now returned by the validation functions. The TxFetcher.Enqueue method is updated to check for this specific error. If it's encountered, the function immediately stops processing further transactions from that peer and flags the peer for disconnection. This effectively mitigates the DoS attack by quickly identifying and banning malicious actors.

A secondary fix was identified in PrivateKey.Decrypt within crypto/ecies/ecies.go, where a message length check was made more robust. This was likely part of the same set of DoS fixes and addresses a potential issue with malformed encrypted messages.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.