CLIENT SECURITY

Geth vulnerabilities by version

By Michael Lip (Mike), independent smart contract security researcher. Data fetched 2026-11-08.

Geth (go-ethereum) is an Ethereum execution client. The tables below map its published security issues to versions, from three sources: the 17 advisories published on the ethereum/go-ethereum GitHub repository, the 26 ids for go-ethereum in the GitHub advisory database, and the 12 entries in the Geth team's own vulnerabilities.json file. The three sources disagree on severity and coverage; the merged table shows both severity labels side by side.

On this page Version lookup Method Key findings Merged table All releases Fix ladder If you run a node Limitations

Look up a Geth version

Check a Geth version against the 26 GitHub advisory database ranges

Check

Enter a Geth version such as 1.16.8, v1.13.15 or a client string like Geth/v1.16.8-stable/linux-amd64/go1.22.1.

The lookup reads the version number only. A suffix such as -stable or -unstable is ignored, and so is the rest of a client string after the version. For a client string with a node name, such as Geth/mynode/v1.16.8-stable/linux-amd64/go1.22.1, the name is skipped.

How we know these numbers

We pulled the 17 advisories from the GitHub Security Advisory API for the ethereum/go-ethereum repository, the 26 ids from the GitHub advisory database for ecosystem go and package github.com/ethereum/go-ethereum, and the 12 entries from the Geth site's vulnerabilities.json file. All three were fetched 2026-11-08. A second fetch on 2026-11-08 at 03:34 UTC gave the same records, and the release dates come from the Geth releases list on GitHub. Ranges, severities and patched versions are shown verbatim from each record. The per-release table applies the affected version range of each of the 17 repository advisories (for example ">= 1.10.0, < 1.10.8") to each release. The lookup uses the ranges of the 26 GitHub advisory database ids instead.

Key findings

• The first release with no repository advisory in range is v1.17.0 (2026-02-17). Every release in the v1.17.x line up to v1.17.10 (2026-10-23) has zero repository advisories in range, and v1.17.10 is also outside the range of all 26 GitHub advisory database ids. No release of the lines v1.9.x to v1.16.x is clear of the 17 repository advisories. The newest release of each of those lines is still in the range of at least one of them. v1.16.9 is the last 1.16.x release. It is still in the range of GHSA-689v-6xwf-5jf3 (< 1.17.0, medium), which v1.17.0 fixes.
• GHSA-m6gx-rhvj-fh52 is the only id that both GitHub sources rate critical. The repository record gives it CVE-2020-28362. It is a denial of service caused by a bug in Go, so exposure depends on the Go version that built Geth, not only on the Geth version. The repository advisory lists v1.9.24 as the first patched version. The Geth vulnerabilities.json file also rates CVE-2020-26241 (GETH-2020-03) and CVE-2020-26242 (GETH-2020-04) Critical. The repository records rate both high, and the GitHub database rates both medium.
• Three releases are the first patched version of two repository advisories each, the most for any release. v1.9.24 is listed for CVE-2020-26240 and CVE-2020-28362, v1.16.8 fixed CVE-2026-22862 (high) and CVE-2026-22868 (medium), and v1.16.9 fixed CVE-2026-26314 (high) and CVE-2026-26315 (medium).
• Each stable v1.9.x release is in the range of 8 to 14 of the 17 repository advisories. In total, 14 different repository advisories affect the v1.9.x line. Releases before v1.9.24 are also in the range of the critical GHSA-m6gx-rhvj-fh52, subject to the Go version note above.

The merged advisory table (all three sources)

One row per GitHub advisory database id, plus the one vulnerabilities.json entry that appears in neither GitHub source (GETH-2021-01). "Repository range" and "maintainer severity" come from the ethereum/go-ethereum repository advisory record; "database range" and "database severity" come from the GitHub advisory database record. Seven ids show a different severity in the database than in the repository record. Six ids list no patched version in the GitHub database.

Notes on individual ids. GHSA-v9jh-j8px-98vq (CVE-2023-42319, GraphQL DoS): the record adds this note (the inner quotation mark is not closed in the record): NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic. The record lists no patched version. Six ids (GHSA-v9jh, GHSA-rqmg, GHSA-vrcc, GHSA-pvx3, GHSA-vmf7 and GHSA-5m8f) have no patched version in the GitHub database. Their ranges end at an upper bound such as <= 1.10.21. This means that the database lists no fix. It does not mean that current versions are affected. This page does not call these issues confirmed. GHSA-m6gx-rhvj-fh52 (denial of service due to Go CVE-2020-28362): whether a build is exposed depends on the Go version that built Geth, because the bug is in Go. Both GitHub records rate it critical. The GitHub database record has no CVE id. The repository record and vulnerabilities.json (GETH-2020-02) give CVE-2020-28362. GETH-2021-01 (not ready for London upgrade) appears only in vulnerabilities.json. GitHub has no advisory record for it.

The Geth disclosures page says: "As of version 1.9.25 , Geth has a built-in command to check whether it is affected by any publicly disclosed vulnerability, using the command geth version-check ." That command fetches the vulnerabilities.json file. The file stops at GETH-2024-01 (published 2024-05-06). It does not list the six repository advisories published after it, one in 2025 (GHSA-q26p) and five in 2026. So geth version-check alone does not report them.

Stable Geth releases v1.9.0 to v1.17.10 and their repository advisories

125 stable releases from v1.9.0 to v1.17.10, checked against the 17 repository advisory ranges. "First in line" marks the first release (x.y.0) of each minor line. The fix ladder below names the newest release of each line. The table starts at v1.9.0. Older releases are not listed here; the lookup above accepts them. The nine global-only ids are not counted in this table.

The fix ladder by minor line

No release of the lines v1.9.x to v1.16.x is clear of the 17 repository advisories. The newest release of each of these lines is still in the range of at least one advisory. The first clear release is v1.17.0.

What this means if you run a node

The Geth SECURITY.md file says: "We recommend using the most recently released version." On 2026-11-08 that was v1.17.10 (published 2026-10-23). If a specific fork, tooling pin or chain requirement forces an older line, there is no release in that line that clears all 17 repository advisories; check the merged table for what still applies. Four of the five repository advisories published in 2026 have the title "DoS via malicious p2p message". The fifth concerns ECIES public key validation in the RLPx handshake.

Limitations

This page reflects the three sources as fetched on 2026-11-08. The Geth disclosure policy says: "If we silently fix a vulnerability and include the fix in release X , then, After 4-8 weeks, we will disclose that X contained a security-fix. After an additional 4-8 weeks, we will publish the details about the vulnerability." So a current release can contain a fix that no advisory lists yet. The per-release table counts, for each release, the repository advisories whose range includes that exact release. The three sources can give different ranges for the same issue. For GHSA-4xc9-8hmq-j652, vulnerabilities.json (GETH-2024-01) says introduced v1.10.0 and fixed v1.13.15, while the GitHub records say < 1.13.15 with no lower bound. The lookup and the tables use the GitHub ranges and show the vulnerabilities.json range in its own columns.

Related: Solidity compiler bugs by version, Vyper compiler bugs by version, OpenZeppelin Contracts vulnerabilities by version.