CVE-2020-26241 - CVE House
Back to Database
Status published Medium CVE-2020-26241

Shallow copy bug in geth

Vulnerability Description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26241

Credits & Attribution

No credits recorded in the NVD database.

References

More from ethereum

View All →
CVE-2025-24883
go-ethereum has a DoS via malicious p2p message
High 8.7
CVE-2024-32972
go-ethereum denial of service via malicious p2p message
High 7.5
CVE-2023-40591
Denial of service via malicious p2p message in go-ethereum
High 7.5
CVE-2022-37450
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase...
Medium 5.9
CVE-2022-29177
DoS via malicious p2p message in Go-Ethereum
Medium 5.9

Affected Vendor

Affected Software

go-ethereum
Vulnerable Versions:
>= 1.9.7, < 1.9.17

Timeline

Official Publish: November 25th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-682

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.