CVE-2020-26241

    Dashboard / Vulnerabilities / CVE-2020-26241

    CVE-2020-26241

    Published: 25 Nov 2020Last Modified: 7 Aug 2026

    Summary:

    Details: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.

    References: https://blog.ethereum.org/2020/11/12/geth_security_release/, https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -748f22c192d24082723f935afd0b0b63e7fd50f4

    Affected versions

    v1.9.16
    v1.9.15
    v1.9.14
    v1.9.13
    v1.9.12
    v1.9.11
    v1.9.10
    v1.9.9
    v1.9.8
    v1.9.7
    v1.9.6
    v1.9.5
    v1.9.4
    v1.9.3
    v1.9.2
    v1.9.1
    v1.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-26241 | CVE-DB