CVE-2020-26264

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
ethereum	go-ethereum	< 1.9.25

References

https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/21896Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qThird Party Advisory
https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/21896Patch, Third Party Advisory
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29qThird Party Advisory

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-262655.3Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 CVE-2020-262665.3In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is CVE-2020-262677.8In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The c CVE-2020-262684.4In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which CVE-2020-262697.5In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerabl CVE-2020-26276.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.18 and p CVE-2020-262703.3In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK CVE-2020-262713.3In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building th CVE-2020-262726.5The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prio CVE-2020-262735.2osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sq CVE-2020-262748.8In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 CVE-2020-262756.1The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter noteboo