CVE-2020-26264

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.

• CWE-400
• CWE-400

• https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46Patch, Third Party Advisory
• https://github.com/ethereum/go-ethereum/pull/21896Patch, Third Party Advisory
• https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25Third Party Advisory
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qThird Party Advisory
• https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46Patch, Third Party Advisory
• https://github.com/ethereum/go-ethereum/pull/21896Patch, Third Party Advisory
• https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25Third Party Advisory
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qThird Party Advisory

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26259XStream is a Java library to serialize objects to XML and ba…6.8
• CVE-2020-2626Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26260BookStack is a platform for storing and organising informati…6.4
• CVE-2020-26261jupyterhub-systemdspawner enables JupyterHub to spawn single…7.9
• CVE-2020-26262Coturn is free open source implementation of TURN and STUN S…7.2
• CVE-2020-26263tlslite-ng is an open source python library that implements …7.5
• CVE-2020-26265Go Ethereum, or "Geth", is the official Golang implementatio…5.3
• CVE-2020-26266In affected versions of TensorFlow under certain cases a sav…5.3
• CVE-2020-26267In affected versions of TensorFlow the tf.raw_ops.DataFormat…7.8
• CVE-2020-26268In affected versions of TensorFlow the tf.raw_ops.ImmutableC…4.4
• CVE-2020-26269In TensorFlow release candidate versions 2.4.0rc*, the gener…7.5
• CVE-2020-2627Vulnerability in the MySQL Server product of Oracle MySQL (c…6.5