{"id":18245,"date":"2026-03-13T09:30:08","date_gmt":"2026-03-13T09:30:08","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/03\/13\/geth-security-release-ethereum-foundation-blog\/"},"modified":"2026-03-13T09:30:08","modified_gmt":"2026-03-13T09:30:08","slug":"geth-security-release-ethereum-foundation-blog","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/03\/13\/geth-security-release-ethereum-foundation-blog\/","title":{"rendered":"Geth security release | Ethereum Foundation Blog"},"content":{"rendered":"


\n<\/p>\n

\n

<\/g><\/svg><\/a>Summary<\/h2>\n

Versions of geth<\/span> built with Go or are most likely affected by a critical DoS-related security vulnerability. The golang team has registered this flaw as ‘CVE-2020-28362’.<\/span><\/span><\/p>\n

We recommend all users to rebuild (ideally v1.9.24<\/span>) with Go 1.15.5<\/span> or 1.14.12<\/span>, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24<\/span> ourselves built with Go 1.15.5<\/span>.<\/p>\n

Docker images will most probably be out of date due to a missing base image, but you can check the release notes on how to temporarily build one with Go 1.15.5<\/span>. Please run geth version<\/span> to verify the Go version your binary was built with.<\/p>\n

<\/g><\/svg><\/a>Background<\/h2>\n

In early October, go-ethereum enrolled into Google’s OSS-Fuzz<\/a> program. We had previosly executed fuzzers on an ad-hoc basis and tested some different platforms.<\/p>\n

On 2020-10-24, we were notified that one of our fuzzers had found a crash.<\/p>\n

Upon investigation, it turned out that the root cause of the issue was a bug in the standard libraries of Go, and the issue was reported upstream.<\/p>\n

Special thanks to Adam Korczynski<\/a> of Ada Logics for the initial integration of go-ethereum into OSS-Fuzz!<\/p>\n

<\/g><\/svg><\/a>Impact<\/h2>\n

The DoS issue can be used to crash all Geth nodes during block processing, the effects of which would be that a major part of the Ethereum network went offline.<\/p>\n

Outside of Go-Ethereum, the issue is most likely relevant for all forks of Geth (such as TurboGeth or ETC’s core-geth). For an even wider context, we would refer to upstream, as the Go-team have performed an investigation of potentially affected parties.<\/p>\n

<\/g><\/svg><\/a>Timeline<\/h2>\n