CVE-2020-26264: 
Ethereum Geth vulnerability analysis and mitigation

Go Ethereum (Geth), the official Golang implementation of the Ethereum protocol, was found to contain a denial-of-service vulnerability in versions before 1.9.25. The vulnerability was identified with CVE-2020-26264 and was discovered in late 2020. The issue specifically affected the LES (Light Ethereum Subprotocol) server functionality (GitHub Advisory).

The vulnerability allowed a malicious LES client to crash a LES server through a specially crafted GetProofsV2 request. This issue only affected nodes that explicitly enabled the LES server functionality. The vulnerability was assigned a moderate severity rating and was tracked as CVE-2020-26264 (GitHub Advisory).

When exploited, the vulnerability could cause a denial-of-service condition, resulting in the crash of the LES server. This would affect the availability of the light client service for legitimate users (GitHub Advisory).

The vulnerability could be exploited by any connected LES client sending malicious GetProofsV2 requests to a LES server. The attack required the target node to have explicitly enabled LES server functionality (GitHub Advisory).

The vulnerability was patched in Geth version 1.9.25. Users running affected versions could either upgrade to v1.9.25 or later, or disable the LES server functionality as a temporary workaround. The fix was implemented through a patch that addressed the handling of GetProofsV2 requests (Geth Release).