Ethereum vulnerabilities
We track 14 vulnerabilities in Ethereum products across 3 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on April 9, 2026.
Latest Ethereum vulnerabilities
- 7.2 High severity
web3.py: Server-Side Request Forgery
web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_pay
- 7.5 High severity
go-ethereum: Observable Discrepancy
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the
- 7.5 High severity
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of
- 7.5 High severity
go-ethereum: Allocation of Resources Without Limits or Throttling
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release.
- 7.5 High severity
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.
- 7.5 High severity
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.
- 8.7 High severity
go-ethereum: Uncaught Exception
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.
- 9.8 Critical severity
ethereum: Improper Control of Generation of Code
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- 8.8 High severity
ethereum: Incorrect Authorization
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- 8.8 High severity
ethereum: Incorrect Authorization
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
- 9.8 Critical severity
ethereum: Improper Control of Generation of Code
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls
- 7.5 High severity
go-ethereum: Uncontrolled Resource Consumption
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has
- 7.5 High severity
go-ethereum: Uncontrolled Resource Consumption
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth v
- 7.5 High severity
Go Ethereum: Uncontrolled Resource Consumption
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions