go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9c8c00ce-3642-11f1-bd03-3c7c3fba4204 advisory.

    https://github.com/ethereum/go-ethereum/security/advisories reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version
    1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is
    resolved in the v1.17.0 release. (CVE-2026-26313)

  - go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version
    1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem
    is resolved in the v1.16.9 and v1.17.0 releases of Geth. (CVE-2026-26314)

  - go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version
    1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits
    of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers
    recommend rotating the node key after applying the upgrade, which can be done by removing the file
    `<datadir>/geth/nodekey` before starting Geth. (CVE-2026-26315)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version
    1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits
    of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers
    recommend rotating the node key after applying the upgrade, which can be done by removing the file
    `<datadir>/geth/nodekey` before starting Geth. (CVE-2026-26315)

ID	Name	Product	Family	Severity
307386	FreeBSD : go-ethereum -- vulnerabilities (9c8c00ce-3642-11f1-bd03-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	high
438138	Alpine: multiple geth packages: security update to 1.17.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
438138	Alpine: multiple geth packages: security update to 1.17.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
437846	SCA: security update for github.com/ethereum/go-ethereum (GHSA-m6j8-rg6r-7mv8)	Tenable Cloud Security	SCA Checks	medium
437846	SCA: security update for github.com/ethereum/go-ethereum (GHSA-m6j8-rg6r-7mv8)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-26315

medium

Tenable Plugins

high

high

high

medium

medium