CVE-2020-26265

    Dashboard / Vulnerabilities / CVE-2020-26265

    CVE-2020-26265

    Published: 11 Dec 2020Last Modified: 7 Aug 2026

    Summary:

    Details: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to upgrade to a newer version.

    References: https://github.com/ethereum/go-ethereum/releases/tag/v1.9.20, https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 46891c12ab54c9e179f26378ce618fd48460190c
    Fixed -979fc96899c77876e15807005eadd936da17b6c2

    Affected versions

    v1.9.19
    v1.9.18
    v1.9.17
    v1.9.16
    v1.9.15
    v1.9.14
    v1.9.13
    v1.9.12
    v1.9.11
    v1.9.10
    v1.9.9
    v1.9.8
    v1.9.7
    v1.9.6
    v1.9.5
    v1.9.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-26265 | CVE-DB