CVE-2020-26264— LES Server DoS via GetProofsV2
Quick assessment
Affected
ethereum go-ethereum
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ethereum Go-ethereum是Ethereum社区的一个用Go语言实现以太坊协议的代码库。 Ethereum Go-ethereum 1.9.25存在安全漏洞，该漏洞源于拒绝服务漏洞可以通过来自已连接LES客户端的恶意GetProofsV2请求使LES服务器崩溃。此漏洞只涉及显式启用les server的用户;禁用les可以防止攻击。该漏洞在1.9.25版本中被修补。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-26264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LES Server DoS via GetProofsV2
Source: CVE Program / CVE List V5
Vulnerability Description
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Ethereum Go-ethereum 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ethereum Go-ethereum是Ethereum社区的一个用Go语言实现以太坊协议的代码库。 Ethereum Go-ethereum 1.9.25存在安全漏洞，该漏洞源于拒绝服务漏洞可以通过来自已连接LES客户端的恶意GetProofsV2请求使LES服务器崩溃。此漏洞只涉及显式启用les server的用户;禁用les可以防止攻击。该漏洞在1.9.25版本中被修补。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ethereum | go-ethereum | < 1.9.25 | - |
|
II. Public POCs for CVE-2020-26264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-26264
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-26264 (2)
-
https://github.com/ethereum/go-ethereum/pull/21896 x_refsource_MISC
Vendor Advisories for CVE-2020-26264 (1)
-
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q x_refsource_CONFIRM
Other References for CVE-2020-26264 (1)
-
https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25 x_refsource_MISC
IV. Related Vulnerabilities
Same product: go-ethereum
-
CVE-2026-26315
Go Ethereum Improperly Validates the ECIES Public Key in RLP -
CVE-2026-26314
Go Ethereum affected by DoS via malicious p2p message -
CVE-2026-26313
Go Ethereum affected by DoS via malicious p2p message -
CVE-2026-22868
go-ethereum has a DoS via malicious p2p message -
CVE-2026-22862
go-ethereum has a DoS via malicious p2p message
Same vendor: ethereum
-
CVE-2026-40072
web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLo -
CVE-2026-26315
Go Ethereum Improperly Validates the ECIES Public Key in RLP -
CVE-2026-26314
Go Ethereum affected by DoS via malicious p2p message -
CVE-2026-26313
Go Ethereum affected by DoS via malicious p2p message -
CVE-2026-22868
go-ethereum has a DoS via malicious p2p message
Same weakness: CWE-400
-
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-77357
Mesop: DoS in /hot-reload endpoint allows unauthenticated at -
CVE-2026-53965
MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables c -
CVE-2026-55588
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursio -
CVE-2026-55099
icalendar: Algorithmic Complexity in Equality
V. Comments for CVE-2020-26264
No comments yet