{"id":"GHSA-m6gx-rhvj-fh52","aliases":["GO-2022-0392"],"status":"published","title":"Denial of service in go-ethereum due to CVE-2020-28362","description":"### Impact\nVersions of Geth built with Go `\u003c1.15.5` or `\u003c1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.\n\nWe recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.\n\n### Patches\nThis is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### Workarounds\nRebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### References\n- https://blog.ethereum.org/2020/11/12/geth_security_release/\n- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-06-29T21:13:54Z","modified":"2026-03-03T04:50:12Z","fixes":[{"ecosystem":"Go","package":"github.com/ethereum/go-ethereum","fixed_in":["1.9.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ethereum/go-ethereum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.24"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ethereum/go-ethereum","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.24"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ethereum/go-ethereum","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.24"}]}]}],"references":[{"url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m6gx-rhvj-fh52"},{"url":"https://github.com/ethereum/go-ethereum","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-m6gx-rhvj-fh52","title":"Denial of service in go-ethereum due to CVE-2020-28362","description":"### Impact\nVersions of Geth built with Go `\u003c1.15.5` or `\u003c1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.\n\nWe recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.\n\n### Patches\nThis is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### Workarounds\nRebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### References\n- https://blog.ethereum.org/2020/11/12/geth_security_release/\n- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)\n","status":"published","published":"2021-06-29T21:13:54Z","modified":"2023-01-09T05:04:49Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-m6gx-rhvj-fh52","title":"Denial of service in go-ethereum due to CVE-2020-28362","description":"### Impact\nVersions of Geth built with Go `\u003c1.15.5` or `\u003c1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.\n\nWe recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.\n\n### Patches\nThis is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### Workarounds\nRebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. \n\n### References\n- https://blog.ethereum.org/2020/11/12/geth_security_release/\n- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)\n","status":"published","published":"2021-06-29T21:13:54Z","modified":"2025-01-30T14:37:03Z","updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"GO-2022-0392","title":"Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum","description":"Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-03-03T04:50:12.374809Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}