What’s Vulnerable › Vulnerabilities
CVE-2026-26315: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-19 · updated 2026-06-17
- Weakness: CWE-203
Description
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.
Affected products
- ethereum go-ethereum: before 1.16.9 — fixed in 1.16.9
How to fix
Upgrade to a fixed version: ethereum go-ethereum 1.16.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-26315 or the next vulnerability affects your stack