CVE Tools
Track your stack

Ethereum

18 CVEs tracked since 2018. Since Jan 2018, none of them reached CISA KEV.

Ethereum CVEs per month

Jan 2018 to Mar 2022. Point at a month, or focus the strip and use the arrow keys.
Ethereum CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-0190
2018-02null or fewer
2018-03null or fewer
2018-04null or fewer
2018-05null or fewer
2018-06null or fewer
2018-07null or fewer
2018-08null or fewer
2018-09null or fewer
2018-10null or fewer
2018-11null or fewer
2018-12null or fewer
2019-01null or fewer
2019-02null or fewer
2019-03null or fewer
2019-04null or fewer
2019-05null or fewer
2019-06null or fewer
2019-07null or fewer
2019-08null or fewer
2019-09null or fewer
2019-10null or fewer
2019-11null or fewer
2019-12null or fewer
2020-01null or fewer
2020-02null or fewer
2020-03null or fewer
2020-04null or fewer
2020-05null or fewer
2020-06null or fewer
2020-07null or fewer
2020-08null or fewer
2020-09null or fewer
2020-10null or fewer
2020-1130
2020-1230
2021-01null or fewer
2021-02null or fewer
2021-03null or fewer
2021-04null or fewer
2021-05null or fewer
2021-06null or fewer
2021-07null or fewer
2021-08null or fewer
2021-09null or fewer
2021-10null or fewer
2021-11null or fewer
2021-12null or fewer
2022-01null or fewer
2022-02null or fewer
2022-0330

Products

The products that kept showing up in Ethereum's monthly top three, with their CVEs summed over those months.

  1. Go Ethereum83 months
  2. Cpp-ethereum71 month
  3. Go-ethereum52 months
  4. Aleth11 month
  5. Ethereum11 month
  6. Ethereum Virtual Machine11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Ethereum.

  1. CVE-2026-40072web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling7.2
  2. CVE-2026-26315Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake7.5
  3. CVE-2026-26314Go Ethereum affected by DoS via malicious p2p message7.5
  4. CVE-2026-26313Go Ethereum affected by DoS via malicious p2p message7.5
  5. CVE-2026-22868go-ethereum has a DoS via malicious p2p message7.5
  6. CVE-2026-22862go-ethereum has a DoS via malicious p2p message7.5
  7. CVE-2015-20112RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.3.4
  8. CVE-2025-24883go-ethereum has a DoS via malicious p2p message—
  9. CVE-2024-32972go-ethereum denial of service via malicious p2p message7.5
  10. CVE-2023-42319Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: th...7.5
  11. CVE-2023-36980An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.5.3
  12. CVE-2023-40591Denial of service via malicious p2p message in go-ethereum7.5
  13. CVE-2022-1930ReDoS in eth-account encode_structured_data function5.9
  14. CVE-2022-37450Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main...5.9
  15. CVE-2022-29177DoS via malicious p2p message in Go-Ethereum5.9

The record

Peak rank
#43 in Jan 2018
Busiest month shown
Jan 2018, 9 CVEs
Months with a KEV entry
0 since Jan 2018
Monthly snapshots
4 since 2018
Ethereum's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store