ethereum vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-26314 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 8.7 · Feb 19, 2026
• CVE-2026-22868 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 7.1 · Jan 13, 2026
• CVE-2026-22862 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 7.1 · Jan 13, 2026
• CVE-2025-24883 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 8.7 · Jan 30, 2025
• CVE-2024-51427 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCritical 9.8 · Oct 30, 2024
• CVE-2024-51426 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer fuHigh 8.8 · Oct 30, 2024
• CVE-2024-51425 An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact.High 8.8 · Oct 30, 2024
• CVE-2024-51424 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwnCritical 9.8 · Oct 30, 2024
• CVE-2024-32972 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 7.5 · May 6, 2024
• CVE-2023-42319 Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) High 7.5 · Oct 18, 2023
• CVE-2023-40591 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.High 7.5 · Sep 6, 2023
• CVE-2021-42219 Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to High 7.5 · Mar 16, 2022
• CVE-2022-23328 A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spendHigh 7.5 · Mar 4, 2022
• CVE-2022-23327 A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which canHigh 7.5 · Mar 4, 2022
• CVE-2017-14451 An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum.Critical 10 · Dec 2, 2020
• CVE-2018-15890 An issue was discovered in EthereumJ 1.8.2.Critical 9.8 · Jun 20, 2019
• CVE-2018-20421 Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then High 7.5 · Dec 23, 2018
• CVE-2018-19184 cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode.High 7.5 · Nov 11, 2018
• CVE-2018-18920 Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' wasHigh 8.8 · Nov 11, 2018
• CVE-2018-16733 In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.High 7.5 · Sep 8, 2018
• CVE-2018-12018 The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer High 7.5 · Jul 4, 2018