Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M

CVE-2026-26315Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

Medium 6.9

In plain English

A medium-severity security flaw in go-ethereum from ethereum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 56.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	geth	1.17.0-r0	ALPINE-CVE-2026-26315
Alpine:v3.24	geth	1.17.0-r0	ALPINE-CVE-2026-26315
Go	github.com/ethereum/go-ethereum	1.16.9	GHSA-m6j8-rg6r-7mv8
Go	github.com/ethereum/go-ethereum	1.16.9	GO-2026-4511

Affected products (as reported)

Vendor	Product	Versions
ethereum	go-ethereum	< 1.16.9

Weakness: CWE-203 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8 x_refsource_CONFIRM