Skip to content

Address CVE-2026-22868 - #45

Merged
ermyas merged 2 commits into
mainfrom
CVE-2026-22868
Jan 14, 2026
Merged

Address CVE-2026-22868#45
ermyas merged 2 commits into
mainfrom
CVE-2026-22868

Conversation

@ermyas

@ermyasermyas commented Jan 14, 2026

Copy link
Copy Markdown
Contributor

This PR adds a patch from Geth upstream that addresses CVE-2026-22868.


Note

Addresses a security issue in the p2p ECIES layer and publishes a new beta.

  • Tightens ciphertext validation in crypto/ecies/ecies.go by requiring rLen + hLen + params.BlockSize (ensuring IV presence) instead of + 1 in Decrypt
  • Bumps version metadata to beta.17 in params/version.go
  • Adds v1.0.0-beta.17 entry to CHANGELOG.md noting the security fix (CVE-2026-22868)

Written by Cursor Bugbot for commit d4bfa98. This will update automatically on new commits. Configure here.

@ermyas
ermyas requested a review from a team as a code ownerJanuary 14, 2026 01:46
@ermyas
ermyas merged commit 952166b into mainJan 14, 2026
8 checks passed
@ermyas
ermyas deleted the CVE-2026-22868 branch January 14, 2026 02:17
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@ermyas@drinkcoffee@lfportal