8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26314

CVE-2026-26314: Go Ethereum affected by DoS via malicious p2p message

Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message. More details to be released later.

Patches

The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26314

CVE-2026-26314:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ethereum/go-ethereum	go	<= 1.16.8	1.16.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in go-ethereum caused by processing a specially crafted p2p message. The analysis of the patch commit 895a8597cb16c02203e38707ed2d1da5c500fe60 reveals that the vulnerability lies in the cryptographic library secp256k1 used for handling elliptic curve operations.

The core of the issue is improper input validation of elliptic curve points. When a node receives a p2p message containing cryptographic data like a public key or a signature, it needs to deserialize and validate the associated elliptic curve points. The patch shows that the functions responsible for this validation were missing crucial checks.

Specifically, the coordinates of the points were not checked to be within the valid range of the curve's field. An attacker could craft a message with a point having coordinates larger than the curve's prime modulus. When the vulnerable node attempts to perform cryptographic operations on this invalid point, it can lead to a panic or crash in the underlying C or Go code, causing a denial of service.

The patch addresses this by adding checks in three places:

In crypto/secp256k1/curve.go, the IsOnCurve method for BitCurve now validates the coordinates against the curve's prime P.
In the C-level code crypto/secp256k1/ext.h, the secp256k1_ext_scalar_mul function now checks the return value of secp256k1_fe_set_b32_limit, which fails for out-of-range values.
In crypto/signature_nocgo.go (for builds without cgo), a new IsOnCurve method is added for btCurve to perform the same coordinate validation.

Any p2p message that triggers public key recovery or signature verification could be a vector for this attack. The identified functions are directly involved in the validation process that was initially flawed. During exploitation, a profiler would likely show these functions being called with the malicious input just before the crash.

Vulnerable functions

secp256k1.BitCurve.IsOnCurve

crypto/secp256k1/curve.go

This function checks if a given point (x,y) is on the secp256k1 elliptic curve. The vulnerability lies in the fact that prior to the patch, this function did not validate whether the point's coordinates were within the finite field of the curve. An attacker could supply a point with coordinates larger than the curve's prime modulus 'P'. Subsequent cryptographic operations on this invalid point would cause a panic, leading to a denial of service. The patch adds a check to ensure the coordinates are within the valid range.

secp256k1_ext_scalar_mul

crypto/secp256k1/ext.h

This C function is used for scalar multiplication on the curve and involves deserializing a point from a byte array. The vulnerability was that the function did not check the return value of `secp256k1_fe_set_b32_limit`, which is responsible for converting a byte representation to a field element and validating it. This allowed an invalid point with out-of-range coordinates to be processed, leading to a crash. The patch introduces a check on the return value to prevent this.

crypto.btCurve.IsOnCurve

crypto/signature_nocgo.go

This function was added to provide proper point validation for builds of go-ethereum compiled without cgo. The vulnerability existed because, in the absence of this method, the underlying `KoblitzCurve.IsOnCurve` was called, which lacked the check to ensure point coordinates were within the curve's field. This function is a direct indicator of the fix, and its absence in vulnerable versions is what allows the exploit. It validates the coordinates before calling the original `IsOnCurve` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26314: Go Ethereum affected by DoS via malicious p2p message

Impact

Patches

Credit

CVE-2026-26314:

8.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2026-26314: Go Ethereum affected by DoS via malicious p2p message

Impact

Patches

Credit

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.7

8.7

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI