CVE-2020-26242: 
Ethereum Geth vulnerability analysis and mitigation

Go Ethereum (Geth), the official Golang implementation of the Ethereum protocol, was found to contain a Denial-of-Service vulnerability in versions before 1.9.18. The vulnerability was discovered in November 2020 and could cause a crash during block processing (NVD, GitHub Advisory).

The vulnerability exists in the MULMOD operation when specifying a modulo of 0 (mulmod(a,b,0)), which causes a panic in the underlying uint256 library. The crash occurs due to a buffer underflow where if d == 0, dLen remains 0 and attempts to access index [-1]. The issue was introduced when the uint256 library was first merged on June 8, 2020 (GitHub Advisory).

When exploited, this vulnerability would cause all vulnerable nodes to drop off the network. The issue was initially discovered through a bug report showing a panic occurring during synchronization from genesis on the Ropsten network (GitHub Advisory).

The vulnerability can be triggered through block processing, specifically by crafting transactions that use the MULMOD operation with a modulo of 0. This makes it relatively straightforward to exploit in practice (GitHub Advisory).

The vulnerability was fixed in Geth version 1.9.18. Users are advised to upgrade to this version or higher. No other workarounds were available at the time of disclosure (GitHub Advisory).