go.mod: update module github.com/ethereum/go-ethereum to v1.17.0 [SECURITY]#21
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Author
ℹ️ Artifact update noticeFile name: eth-trie/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.16.6→v1.17.0go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node
CVE-2026-22862 / GHSA-mr7q-c9w9-wh4h
More information
Details
Impact
A vulnerable node can be forced to shutdown/crash using a specially crafted message.
More details to be released later.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message
CVE-2026-22868 / GHSA-mq3p-rrmp-79jg
More information
Details
Impact
An attacker can cause high CPU usage by sending a specially crafted p2p message.
More details to be released later.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum affected by DoS via malicious p2p message
CVE-2026-26313 / GHSA-689v-6xwf-5jf3
More information
Details
Impact
An attacker can cause high memory usage by sending a specially-crafted p2p message.
More details to be released later.
Patches
The issue is resolved in the v1.17.0 release.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by @revofusion
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum affected by DoS via malicious p2p message
CVE-2026-26314 / GHSA-2gjw-fg97-vg3r
More information
Details
Impact
A vulnerable node can be forced to shutdown/crash using a specially crafted message.
More details to be released later.
Patches
The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
CVE-2026-26315 / GHSA-m6j8-rg6r-7mv8
More information
Details
Impact
Through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key.
Patches
The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. We recommend rotating the node key after applying the upgrade, which can be done by removing the file
<datadir>/geth/nodekeybefore starting Geth.Credit
The issue was reported as a public pull request to go-ethereum by @fengjian.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message
CVE-2026-22868 / GHSA-mq3p-rrmp-79jg / GO-2026-4314
More information
Details
Impact
An attacker can cause high CPU usage by sending a specially crafted p2p message.
More details to be released later.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by @Yenya030
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node
CVE-2026-22862 / GHSA-mr7q-c9w9-wh4h / GO-2026-4315
More information
Details
Impact
A vulnerable node can be forced to shutdown/crash using a specially crafted message.
More details to be released later.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum
CVE-2026-22868 / GHSA-mq3p-rrmp-79jg / GO-2026-4314
More information
Details
High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum
CVE-2026-22862 / GHSA-mr7q-c9w9-wh4h / GO-2026-4315
More information
Details
DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Go Ethereum affected by DoS via malicious p2p message
CVE-2026-26314 / GHSA-2gjw-fg97-vg3r / GO-2026-4507
More information
Details
Impact
A vulnerable node can be forced to shutdown/crash using a specially crafted message.
More details to be released later.
Patches
The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
CVE-2026-26315 / GHSA-m6j8-rg6r-7mv8 / GO-2026-4511
More information
Details
Impact
Through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key.
Patches
The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. We recommend rotating the node key after applying the upgrade, which can be done by removing the file
<datadir>/geth/nodekeybefore starting Geth.Credit
The issue was reported as a public pull request to go-ethereum by @fengjian.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum
CVE-2026-26314 / GHSA-2gjw-fg97-vg3r / GO-2026-4507
More information
Details
Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereum
CVE-2026-26315 / GHSA-m6j8-rg6r-7mv8 / GO-2026-4511
More information
Details
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereum
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Go Ethereum affected by DoS via malicious p2p message
CVE-2026-26313 / GHSA-689v-6xwf-5jf3 / GO-2026-4508
More information
Details
Impact
An attacker can cause high memory usage by sending a specially-crafted p2p message.
More details to be released later.
Patches
The issue is resolved in the v1.17.0 release.
Credit
This issue was reported to the Ethereum Foundation Bug Bounty Program by @revofusion
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum
CVE-2026-26313 / GHSA-689v-6xwf-5jf3 / GO-2026-4508
More information
Details
Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
ethereum/go-ethereum (github.com/ethereum/go-ethereum)
v1.17.0: Eezo-Inlaid Circuitry (v1.17.0)Compare Source
This is a feature release, with all accumulated development from the last 3 months. See below for the highlights.
Note that this release contains multiple critical security fixes, as well as many bug fixes, and is recommended for all users. However, if you are cautious about upgrades, you can also install v1.16.9 which has just the critical security fixes. Specifically, this release fixes CVE-2026-26313, CVE-2026-26314, CVE-2026-26315.
We recommend recreating your p2p node key after installing this update, which you can do by removing the
DATADIR/geth/nodekeyfile before restarting geth. Note this will cause a change in the p2p node ID, which may break static peering setups.Highlights
Path-based Archive Node with Proofs
The path-based archive node can now serve proofs (via
eth_getProof) for the state of older blocks.You can configure the block range that supports proving independently from other archive state availability. Specifically, you can use the
--history.trienodecommand-line flag to set the amount of blocks for which tree nodes will be tracked.This feature is disabled by default. Note that state history cannot easily be recovered once deleted, as it can only be generated by processing blocks. However, you can enable trienode history (and/or state history) at any time to turn a full node into a partial archive node, keeping state from that point in time onwards.
#32727, #32621, #33551, #32981, #33399, #32913, #33303, #33584, #33329, #33681, #33103, #33098, #33515, #32247
EraE History Support
Geth now suports the EraE file format, an archival format for post-merge chain history.
#32157, #33827
OpenTelemetry Tracing
OpenTelemetry tracing is now supported by the RPC server, including support for distributed tracing.
We have also added some tracing spans for block processing via the engine API, i.e.
engine_newPayload.#33599, #33452, #33780, #33521
All Changes
Geth CLI
geth version-checksubcommand has been removed. This command checked the geth website for signed vulnerability notices, and would tell if updates are necessary (#33498)--miner.maxblobscommand-line flag to set a limit on blobs included in built blocks (#33129, #33302)geth --devmode was fixed (#33146)--rpc.rangelimitflag configures the maximum block range foreth_getLogs(#33163)geth --exitwhensyncedwill now set thefinalizedandsafeblock (#33038)geth --ethstatsnow reports the newPayload processing time to the stats server (#33395)evm blocktestcommand can now read filenames from stdin when no path is provided (#32824)Fork Implementation
Core
OnStateUpdatehook, which is called after all state of a block has been committed. This gives access to the changeset of the block. (#33490)setHeadoperation now unsets the finalized block, in cases where the rolled-back block range extends before it. (#33486)SignatureValuesmethod oftypes.Signernow reports an error for invalid signature sizes (#33647)Library
SignTextWithPassphrasenow works correctly with all supported hardware wallets (#33138)bitutil.XORBytesfunction has been deprecated in favor of stdlib package crypto/subtle (#33331)RPC
eth_getTransactionByHashnow returns theblockTimestampas part of the transaction object (#33709)eth_simulateV1,eth_getLogs,eth_getStorageAthave been improved to better comply with the execution RPC spec (#33007, #33320, #33282)eth_simulateV1now selects the correct set of precompiles for the simulated header (#33363)eth_sendTransactionandeth_fillTransactionnow default to EIP-1559 (#33058)gasPriceis now retrievable for transaction types 0x3 and 0x4 (#33542)ethclient(#33693, #33242, #33464)gethclienthas a new wrapper of thecallTracer(#31510)callTracer, reported logs now contain anindexfield which is the index of the log within the transaction (#33629)P2P Networking
setHeadoperations during sync (#33481)5b99d2b)For a full rundown of the changes please consult the Geth 1.17.0 release milestone.
As with all our previous releases, you can find the:
ethereum/client-go(use "stable" tag).v1.16.9: Shield Focusing Module (v1.16.9)Compare Source
This is a security hot-fix release. Specifically, this release fixes CVE-2026-26314, CVE-2026-26315.
We recommend recreating your p2p node key after installing this update, which you can do by removing the
DATADIR/geth/nodekeyfile before restarting geth. Note this will cause a change in the p2p node ID, which may break static peering setups.As with all our previous releases, you can find the:
ethereum/client-go(use "stable" tag).v1.16.8: Moisture Filters (v1.16.8)Compare Source
This is a security fix release and is recommended for all users. It resolves two p2p
vulnerabilities reported through the Ethereum Foundation bug bounty program.
As with all our previous releases, you can find the:
ethereum/client-go(use "stable" tag).v1.16.7: Ballistic Drift Stabilizer (v1.16.7)Compare Source
This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.
This release enables the Fusaka hardfork on Ethereum mainnet.
The Fusaka fork is scheduled to occur at
2025-12-03 21:49:11 UTC.Please upgrade your node to v1.16.7 in time for the fork.
This release also enables two blob-parameter-only (BPO) upgrades.
These upgrades change protocol parameters to increase the available blob capacity.
2025-12-092026-01-07Fusaka
geth --devmode (#32917)RPC
eth_sendRawTransactionSyncwhich waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)eth_simulateV1in ethclient (#32856)debug_traceCall(#33015)Core
geth --genesisflag as an alternative to runninggeth init genesis.json(#32844)eth_getProofrequest with the new path-based archive node. (#32907, #32914, #32937)Networking
For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.
As with all our previous releases, you can find the:
ethereum/client-go(use "stable" tag).Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.