CVE-2018-12018

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-05 · updated 2026-06-17
Weakness: CWE-129

Description

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.

Affected products

ethereum go-ethereum: before 1.8.11 — fixed in 1.8.11

How to fix

Upgrade to a fixed version: ethereum go-ethereum 1.8.11. Check the vendor advisory for mitigations.

References

https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4
https://github.com/ethereum/go-ethereum/pull/16891
https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11
https://peckshield.com/2018/06/27/EPoD/
https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4
https://github.com/ethereum/go-ethereum/pull/16891
https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11
https://peckshield.com/2018/06/27/EPoD/

Get alerted when CVE-2018-12018 or the next vulnerability affects your stack