A specially-crafted peer-to-peer message can cause the Go Ethereum client to allocate excessive memory, resulting in a denial of service. The vulnerability is a type of resource exhaustion flaw, mapped to CWE-770, and can severely impact the availability of the node by exhausting local system memory. If exploited, the attacker may interdict the node’s ability to process normal traffic, potentially affecting the decentralised network it supports.

The vulnerability affects the Go Ethereum (geth) client for all versions earlier than 1.17.0. Users of any operating system that installs geth under the Ethereum organization’s open source distribution are impacted. The issue was fully patched in release 1.17.0.

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. The EPSS score is less than 1%, meaning active exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is primarily remote, through a malicious p2p message sent over the Ethereum peer‑to‑peer network; the attacker does not need to compromise the node locally. Exploitation requires the node to accept the crafted message and process it without proper memory controls.