GHSA-m6gx-rhvj-fh52
Denial of service in go-ethereum due to CVE-2020-28362
GHSA-m6gx-rhvj-fh52 is a vulnerability with no CVSS score yet in github.com/ethereum/go-ethereum, published June 29, 2021. No source lists public exploit code. Fixed in github.com/ethereum/go-ethereum 1.9.24.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.9.24github.com/ethereum/go-ethereum
Description
Impact
Versions of Geth built with Go <1.15.5 or <1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.
We recommend all users to rebuild (ideally v1.9.24) with Go 1.15.5 or 1.14.12, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24 ourselves built with Go 1.15.5.
Patches
This is not an issue in go-ethereum, rebuilding an older version with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
Workarounds
Rebuilding with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
For more information
If you have any questions or comments about this advisory:
- Open an issue in go-ethereum
- Email us at security@ethereum.org
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/ethereum/go-ethereumGo | before 1.9.24 | 1.9.24 |
What each source reports
GitHub AdvisoriesNo score
Denial of service in go-ethereum due to CVE-2020-28362
Impact
Versions of Geth built with Go <1.15.5 or <1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.
We recommend all users to rebuild (ideally v1.9.24) with Go 1.15.5 or 1.14.12, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24 ourselves built with Go 1.15.5.
Patches
This is not an issue in go-ethereum, rebuilding an older version with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
Workarounds
Rebuilding with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
For more information
If you have any questions or comments about this advisory:
- Open an issue in go-ethereum
- Email us at security@ethereum.org
- Record
GHSA-m6gx-rhvj-fh52- Updated
- 2026-11-02
OSVNo score
Denial of service in go-ethereum due to CVE-2020-28362
Impact
Versions of Geth built with Go <1.15.5 or <1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.
We recommend all users to rebuild (ideally v1.9.24) with Go 1.15.5 or 1.14.12, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24 ourselves built with Go 1.15.5.
Patches
This is not an issue in go-ethereum, rebuilding an older version with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
Workarounds
Rebuilding with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.
References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
For more information
If you have any questions or comments about this advisory:
- Open an issue in go-ethereum
- Email us at security@ethereum.org
- Record
GHSA-m6gx-rhvj-fh52- Updated
- 2026-11-02
OSVGO-2022-0392No score
Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum
Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum
- Record
GO-2022-0392- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.