CVE-2025-24883: Go Ethereum vulnerable to DoS via malicious p2p message
(updated )
A vulnerable node can be forced to shutdown/crash using a specially crafted message.
During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1 curve. By simply sending an all-zero public key, a crash could be induced due to unexpected results from the handshake.
The issue was fixed by adding a curve point validity check in https://github.com/ethereum/go-ethereum/commit/159fb1a1db551c544978dc16a5568a4730b4abf3
References
- github.com/advisories/GHSA-q26p-9cq4-7fc2
- github.com/ethereum/go-ethereum
- github.com/ethereum/go-ethereum/commit/159fb1a1db551c544978dc16a5568a4730b4abf3
- github.com/ethereum/go-ethereum/commit/fa9a2ff8687ec9efe57b4b9833d5590d20f8a83f
- github.com/ethereum/go-ethereum/security/advisories/GHSA-q26p-9cq4-7fc2
- nvd.nist.gov/vuln/detail/CVE-2025-24883
- pkg.go.dev/vuln/GO-2025-3436
Code Behaviors & Features
Detect and mitigate CVE-2025-24883 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →