CVE-2021-39137: Consensus flaw during block processing in go-ethereum

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-24 · updated 2026-06-17
Weakness: CWE-436

Description

go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.

Affected products

ethereum go-ethereum: from 1.10.0 before 1.10.8 — fixed in 1.10.8

How to fix

Upgrade to a fixed version: ethereum go-ethereum 1.10.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-39137 or the next vulnerability affects your stack