CVE-2026-22862: 
Ethereum Geth vulnerability analysis and mitigation

CVE-2026-22862 is a Denial of Service (DoS) vulnerability in go-ethereum (geth), the Go implementation of the Ethereum execution layer protocol. A network-accessible attacker can send a specially crafted p2p message to force a vulnerable geth node to shutdown or crash. All versions up to and including 1.16.7 are affected; the vulnerability is fixed in version 1.16.8. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.1 (High) (Github Advisory). The vulnerability was disclosed on January 13, 2026, and was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD (Github Advisory).

The vulnerability is classified as CWE-20 (Improper Input Validation) and stems from insufficient validation of KZG (Kate-Zaverucha-Goldberg) cryptographic proofs in blob transactions received over the peer-to-peer network (Github Advisory). Examination of the patch commit reveals that the fix introduces a new ErrKZGVerificationError error type and modifies the transaction fetcher (eth/fetcher/tx_fetcher.go) to immediately terminate transaction processing and disconnect the offending peer when a KZG verification failure is detected, rather than allowing the malformed message to propagate and crash the node (Patch Commit). An attacker with network access and low privileges (e.g., a peer connection to the target node) can craft a blob transaction with an invalid KZG cell proof and deliver it via the p2p protocol, triggering the crash (Github Advisory). The fix also corrects a bounds check in crypto/ecies/ecies.go related to message length validation, suggesting multiple input validation issues were addressed in the same patch (Patch Commit).

Successful exploitation results in a complete availability impact on the targeted geth node — the node is forced to shutdown or crash, disrupting its participation in the Ethereum network. There is no confidentiality or integrity impact; the attack is purely a denial of service. For node operators running validators, RPC providers, or infrastructure dependent on continuous geth availability, exploitation could cause service outages, missed block proposals, or disruption of downstream applications relying on the node's JSON-RPC interface (Github Advisory).

A proof-of-concept (PoC) repository was published on GitHub shortly after disclosure (PoC Repository). The EPSS score is approximately 0.14%, indicating a low but non-zero probability of exploitation in the wild within 30 days (Github Advisory). No confirmed in-the-wild exploitation or threat actor attribution has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (a peer connection to the target node) and no user interaction, with low attack complexity, making it relatively straightforward for an attacker already connected to the Ethereum p2p network.

1. Reconnaissance: Identify publicly reachable geth nodes running versions <= 1.16.7 using Ethereum network crawlers or tools like devp2p to enumerate peers and their client versions.
2. Establish peer connection: Connect to the target geth node via the Ethereum DevP2P protocol (default port 30303) to establish a valid peer relationship, satisfying the low-privilege requirement.
3. Craft malicious blob transaction: Construct a blob (EIP-4844) transaction with a deliberately invalid KZG cell proof — for example, by generating a valid blob and commitment, computing cell proofs, then mutating one proof byte (e.g., setting cellProof[0][0] = 0x01) as demonstrated in the patch's test code (Patch Commit).
4. Deliver malicious transaction: Announce and deliver the crafted blob transaction to the target node via the p2p transaction propagation protocol (eth protocol NewPooledTransactionHashes / PooledTransactions messages).
5. Trigger crash: The vulnerable node attempts KZG proof verification, fails to handle the error correctly, and crashes or shuts down, achieving denial of service.

• Network: Unexpected disconnection of geth node from the p2p network (port 30303); repeated inbound connections from unknown peers delivering blob transactions shortly before node crash.
• Logs: Geth log entries showing KZG verification errors or panics in transaction processing; log lines referencing invalid blob proof or unhandled errors in eth/fetcher/tx_fetcher.go prior to shutdown; sudden absence of log output indicating process termination.
• Process: Unexpected termination of the geth process without a graceful shutdown signal; process restart events if a supervisor (e.g., systemd) is configured to restart the service automatically.
• File System: Core dump files generated by a geth process crash, if core dumps are enabled on the host system.

The primary remediation is to upgrade go-ethereum (geth) to version 1.16.8 or later, which contains the fix merging the dos-fixes branch (Patch Commit, Github Advisory). As a temporary workaround while patching is underway, operators can implement network-level access controls (e.g., firewall rules or trusted peer lists via --netrestrict) to restrict p2p connections to known, trusted peers, reducing the attack surface. No configuration-only fix is available that fully mitigates the vulnerability without upgrading.

The vulnerability was reported through the Ethereum Foundation Bug Bounty Program, indicating responsible disclosure practices were followed (Github Advisory). Red Hat acknowledged the CVE in their security tracking system shortly after disclosure (Red Hat CVE). A security blog post specifically covering the DoS via malicious p2p message was published at infinitsec.net, and the vulnerability received coverage in a CISA weekly vulnerability summary for the week of January 12, 2026. Community discussion was noted on Bluesky and vulnerability aggregator platforms.