CVE-2021-39137
6.5 MEDIUMgo-ethereum is the official Go implementation of the Ethereum protocol
Published: 2021-08-24 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-436
Affected products
| Vendor | Product |
|---|---|
| ethereum | go_ethereum |
Description
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-39137
- [Other]https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8
- [Other]https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq
- [Other]https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8
- [Other]https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq
Related CVEs
Same vendor
- CVE-2021-41173 — Go Ethereum is the official Golang implementation of the Ethereum protocol (5.7 MEDIUM)
Same CWE
- CVE-2026-42462 — Fedify is a TypeScript library for building federated server apps powered by ActivityPub (7.0 HIGH)
- CVE-2026-47344 — When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accep...
- CVE-2026-40930 — LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files (5.4 MEDIUM)
- CVE-2026-47076 — Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery (6.5 MEDIUM)
- CVE-2026-40165 — authentik is an open-source identity provider (8.7 HIGH)