CVE-2026-22862: Go-Ethereum (Geth) DoS Vulnerability

CVE-2026-22862 Overview

go-ethereum (geth) is a Golang execution layer implementation of the Ethereum protocol. A critical vulnerability exists that allows an attacker to force a vulnerable node to shutdown or crash using a specially crafted message. This Denial of Service vulnerability affects the KZG proof verification process in the transaction pool validation, where improper error handling can lead to node instability.

Critical Impact

Ethereum nodes running vulnerable versions of geth can be remotely crashed by attackers sending specially crafted messages, potentially disrupting blockchain network operations and consensus mechanisms.

Affected Products

• go-ethereum (geth) versions prior to 1.16.8
• Ethereum nodes using vulnerable geth implementations
• Infrastructure relying on geth for Ethereum protocol execution

Discovery Timeline

• January 13, 2026 - CVE CVE-2026-22862 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22862

Vulnerability Analysis

This vulnerability is classified as CWE-20 (Improper Input Validation) and manifests in the transaction pool validation component of go-ethereum. The flaw exists in how the node processes KZG (Kate-Zaverucha-Goldberg) cryptographic proofs associated with blob transactions. When a malformed message is received, the error handling mechanism fails to properly manage the exception, resulting in an uncontrolled node shutdown.

The vulnerability is network-accessible with low attack complexity, requiring only low privileges to exploit. The primary impact is to system availability, as successful exploitation leads to complete denial of service for the affected node.

Root Cause

The root cause lies in improper input validation during KZG proof verification in the transaction pool. Prior to the fix, when an invalid blob proof was encountered during the VerifyBlobProof operation, the error was returned with a generic format that could trigger unexpected behavior in error handling chains. The lack of a specific error type for KZG verification failures meant that upstream error handlers could not properly categorize and manage these failures, leading to crash conditions.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted messages containing malformed KZG proofs to a vulnerable geth node. The attack requires network access to the target node and can be executed remotely. The attacker crafts a transaction with invalid blob sidecar data where the blob, commitment, or proof values fail verification, triggering the improper error handling path that leads to node termination.

// Security patch in core/txpool/errors.go
// Source: https://github.com/ethereum/go-ethereum/commit/abeb78c647e354ed922726a1d719ac7bc64a07e2
// Added new error type for proper KZG verification error handling

 	// ErrInflightTxLimitReached is returned when the maximum number of in-flight
 	// transactions is reached for specific accounts.
 	ErrInflightTxLimitReached = errors.New("in-flight transaction limit reached for delegated accounts")

	// ErrKZGVerificationError is returned when a KZG proof was not verified correctly.
	ErrKZGVerificationError = errors.New("KZG verification error")
 )

// Security patch in core/txpool/validation.go
// Source: https://github.com/ethereum/go-ethereum/commit/abeb78c647e354ed922726a1d719ac7bc64a07e2
// Updated error wrapping for proper error categorization

 	}
 	for i := range sidecar.Blobs {
 		if err := kzg4844.VerifyBlobProof(&sidecar.Blobs[i], sidecar.Commitments[i], sidecar.Proofs[i]); err != nil {
-			return fmt.Errorf("invalid blob %d: %v", i, err)
+			return fmt.Errorf("%w: invalid blob proof: %v", ErrKZGVerificationError, err)
 		}
 	}
 	return nil

Detection Methods for CVE-2026-22862

Indicators of Compromise

• Unexpected geth node crashes or restarts without apparent cause
• Log entries showing KZG proof verification failures prior to node termination
• Increased network traffic containing malformed blob transaction messages
• Multiple failed transaction pool validations from specific peer addresses

Detection Strategies

• Monitor geth logs for invalid blob error messages that precede unexpected shutdowns
• Implement network traffic analysis to detect anomalous blob sidecar data patterns
• Set up automated alerting for repeated node restarts or crash events
• Deploy peer reputation tracking to identify nodes sending malformed transactions

Monitoring Recommendations

• Configure log aggregation to capture and analyze transaction pool validation errors
• Implement health check endpoints to detect and alert on node availability issues
• Monitor peer connection patterns for sources of potentially malicious traffic
• Set up metrics collection for KZG verification failure rates across your node infrastructure

How to Mitigate CVE-2026-22862

Immediate Actions Required

• Upgrade all go-ethereum (geth) installations to version 1.16.8 or later immediately
• Review node logs for any evidence of exploitation attempts prior to patching
• Implement network segmentation to limit exposure of vulnerable nodes during upgrade process
• Consider temporarily restricting peer connections to trusted nodes if immediate upgrade is not possible

Patch Information

The vulnerability is fixed in go-ethereum version 1.16.8. The patch introduces a new ErrKZGVerificationError error type that allows proper categorization and handling of KZG proof verification failures. This change ensures that malformed blob proofs are gracefully rejected without causing node crashes.

For detailed patch information, refer to the GitHub Commit Update and the GitHub Security Advisory.

Workarounds

• Implement firewall rules to restrict P2P network access to known trusted peers
• Deploy monitoring to automatically restart crashed nodes while awaiting patch deployment
• Consider running redundant nodes to maintain availability during potential attack scenarios

# Configuration example - Upgrade geth to patched version
# Stop the running geth service
sudo systemctl stop geth

# Download and install geth 1.16.8 or later
wget https://gethstore.blob.core.windows.net/builds/geth-linux-amd64-1.16.8.tar.gz
tar -xzf geth-linux-amd64-1.16.8.tar.gz
sudo mv geth-linux-amd64-1.16.8/geth /usr/local/bin/

# Verify the installed version
geth version

# Restart the geth service
sudo systemctl start geth