{"id":"CVE-2025-24883","aliases":["GHSA-q26p-9cq4-7fc2","GO-2025-3436"],"url":"https://o3.security/vulnerability/CVE-2025-24883","summary":"go-ethereum has a DoS via malicious p2p message","details":"### Impact\n\nA vulnerable node can be forced to shutdown/crash using a specially crafted message.\n\nDuring the peer-to-peer connection handshake, a shared secret key is computed. The implementation\ndid not verify whether the EC public key provided by the remote party is a valid point on the secp256k1 curve.\nBy simply sending an all-zero public key, a crash could be induced due to unexpected results from the handshake.\n\nThe issue was fixed by adding a curve point validity check in https://github.com/ethereum/go-ethereum/commit/159fb1a1db551c544978dc16a5568a4730b4abf3\n\n### Patches\n\nA fix has been included in geth version 1.14.13 and onwards.\n\n### Workarounds\n\nUnfortunately, no workaround is available.\n\n### Credits\n\nThis issue was originally reported to Polygon Security by David Matosse (@iam-ned).","published":"2025-01-30T15:58:10.488Z","modified":"2026-08-12T03:51:20.268202917Z","cvss":null,"epss":{"score":0.00693,"percentile":0.51291,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/ethereum/go-ethereum","fixedVersion":"1.14.13"}],"fix":{"url":"https://github.com/ethereum/go-ethereum/commit/fa9a2ff8687ec9efe57b4b9833d5590d20f8a83f","label":"ethereum/go-ethereum@fa9a2ff"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24883.json"},{"type":"ADVISORY","url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-q26p-9cq4-7fc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24883"},{"type":"FIX","url":"https://github.com/ethereum/go-ethereum/commit/fa9a2ff8687ec9efe57b4b9833d5590d20f8a83f"},{"type":"WEB","url":"https://github.com/ethereum/go-ethereum/commit/159fb1a1db551c544978dc16a5568a4730b4abf3"},{"type":"PACKAGE","url":"https://github.com/ethereum/go-ethereum"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3436"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:20.268202917Z"}}