The vulnerability allows a specially crafted peer‑to‑peer message to cause the geth node to crash, resulting in a denial of service. It is a flaw in input validation (CWE‑20) that leads to unexpected termination of the execution layer. An attacker cannot compromise confidentiality or integrity, but can render the affected node unavailable for as long as the crash persists.

Ethereum’s Go implementation, geth, is affected in all releases prior to version 1.16.9 and 1.17.0. Users running any earlier version than 1.16.9, including patches before the 1.16.9 release, are susceptible.

This vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. It is not listed in CISA’s KEV catalog. An attacker can exploit it by sending the crafted message through the standard peer‑to‑peer protocol; no local privileges or additional conditions are required beyond network reachability to the node.