PT-2020-16369 · Ethereum · Geth

Holiman · Published 2020-11-25 · Updated 2025-08-08 · CVE-2020-26241

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Geth versions prior to 1.9.17

Description This is a Consensus vulnerability in Geth that can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y.

Recommendations Upgrade to version 1.9.17 or higher to resolve the issue. As a temporary workaround, consider restricting the use of the dataCopy contract until a patch is applied. Avoid using the RETURNDATACOPY opcode in conjunction with the dataCopy contract to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2020-26241

GHSA-69V6-XC2J-R2JF

GO-2022-0771

OPENSUSE-SU-2025:15424-1

Affected Products

Geth

References · 55

• https://blog.ethereum.org/2020/11/12/geth_security_release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26241 · Security Note
• https://osv.dev/vulnerability/GO-2022-0771 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69v6-xc2j-r2jf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26241 · Vendor Advisory
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf · Note
• https://github.com/ethereum/go-ethereum · Note
• https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785 · Note
• https://suse.com/security/cve/CVE-2020-8551 · Note
• https://suse.com/security/cve/CVE-2023-2728 · Note
• https://suse.com/security/cve/CVE-2018-1002101 · Note
• https://suse.com/security/cve/CVE-2020-8563 · Note
• https://suse.com/security/cve/CVE-2021-30465 · Note
• https://suse.com/security/cve/CVE-2018-19184 · Note