You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
enrich_labels.py: for GHSA-advisory-page rows with no /commit//pull/ URL, map
the patched version -> git tag -> the fix commit, but ONLY when it's a small
dedicated security-patch release (prev_tag..tag has ≤6 non-release commits,
best-matched to the advisory summary). Minor-release fixes (huge ranges) are
left unresolved rather than guessed.
Honest yield: the no-commit rows are dominated by CHANGELOG/release-note/NVD/
issue URLs (~576) that map to no single commit — so pre/post code is 80.5% of
the 1,757 codeable rows (60.7% overall), which is the structural ceiling.
BUILD_REPORT coverage note updated to explain it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: data/ethereum_vulns.csv
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -1461,7 +1461,7 @@ The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.
1461
1461
1462
1462
### Credit
1463
1463
1464
-
This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com",https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r,ethereum,2026-07-02T03:45:43Z,Other,N/A,"[""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-689v-6xwf-5jf3"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-mq3p-rrmp-79jg"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-mr7q-c9w9-wh4h"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-q26p-9cq4-7fc2"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26314"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26313"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26315"", ""https://nvd.nist.gov/vuln/detail/CVE-2025-24883"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.14.13"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.15.0"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.16.9"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.17.0""]",,1.0,high,4,A_authoritative,execution,p2p,resource_exhaustion,malicious_p2p_message,[],[],[],,
1464
+
This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com",https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r,ethereum,2026-07-02T03:45:43Z,Other,N/A,"[""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-689v-6xwf-5jf3"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-mq3p-rrmp-79jg"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-mr7q-c9w9-wh4h"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-q26p-9cq4-7fc2"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm"", ""https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26314"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26313"", ""https://nvd.nist.gov/vuln/detail/CVE-2026-26315"", ""https://nvd.nist.gov/vuln/detail/CVE-2025-24883"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.14.13"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.15.0"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.16.9"", ""https://github.com/ethereum/go-ethereum/releases/tag/v1.17.0""]",,1.0,high,4,A_authoritative,execution,crypto,resource_exhaustion,malicious_p2p_message,"[""crypto/secp256k1/curve.go"", ""crypto/secp256k1/ext.h"", ""crypto/signature_nocgo.go""]","[{""file"": ""crypto/secp256k1/curve.go"", ""hunks"": [{""start_line"": 73, ""code"": ""\n// IsOnCurve returns true if the given (x,y) lies on the BitCurve.\nfunc (bitCurve *BitCurve) IsOnCurve(x, y *big.Int) bool {\n\t// y² = x³ + b\n\ty2 := new(big.Int).Mul(y, y) //y²\n\ty2.Mod(y2, bitCurve.P) //y²%P""}]}, {""file"": ""crypto/secp256k1/ext.h"", ""hunks"": [{""start_line"": 109, ""code"": ""\tARG_CHECK(scalar != NULL);\n\t(void)ctx;\n\n\tsecp256k1_fe_set_b32_limit(&feX, point);\n\tsecp256k1_fe_set_b32_limit(&feY, point+32);\n\tsecp256k1_ge_set_xy(&ge, &feX, &feY);\n\tsecp256k1_scalar_set_b32(&s, scalar, &overflow);\n\tif (overflow || secp256k1_scalar_is_zero(&s)) {""}]}, {""file"": ""crypto/signature_nocgo.go"", ""hunks"": [{""start_line"": 164, ""code"": ""\t*secp256k1.KoblitzCurve\n}\n\n// Marshal converts a point given as (x, y) into a byte slice.\nfunc (curve btCurve) Marshal(x, y *big.Int) []byte {\n\tbyteLen := (curve.Params().BitSize + 7) / 8""}]}]","[{""file"": ""crypto/secp256k1/curve.go"", ""hunks"": [{""start_line"": 73, ""code"": ""\n// IsOnCurve returns true if the given (x,y) lies on the BitCurve.\nfunc (bitCurve *BitCurve) IsOnCurve(x, y *big.Int) bool {\n\tif x.Cmp(bitCurve.P) >= 0 || y.Cmp(bitCurve.P) >= 0 {\n\t\treturn false\n\t}\n\n\t// y² = x³ + b\n\ty2 := new(big.Int).Mul(y, y) //y²\n\ty2.Mod(y2, bitCurve.P) //y²%P""}]}, {""file"": ""crypto/secp256k1/ext.h"", ""hunks"": [{""start_line"": 109, ""code"": ""\tARG_CHECK(scalar != NULL);\n\t(void)ctx;\n\n\tif (!secp256k1_fe_set_b32_limit(&feX, point) ||\n\t\t!secp256k1_fe_set_b32_limit(&feY, point+32)) {\n\t\treturn 0;\n\t}\n\tsecp256k1_ge_set_xy(&ge, &feX, &feY);\n\tsecp256k1_scalar_set_b32(&s, scalar, &overflow);\n\tif (overflow || secp256k1_scalar_is_zero(&s)) {""}]}, {""file"": ""crypto/signature_nocgo.go"", ""hunks"": [{""start_line"": 164, ""code"": ""\t*secp256k1.KoblitzCurve\n}\n\nfunc (curve btCurve) IsOnCurve(x, y *big.Int) bool {\n\tif x.Cmp(secp256k1.Params().P) >= 0 || y.Cmp(secp256k1.Params().P) >= 0 {\n\t\treturn false\n\t}\n\treturn curve.KoblitzCurve.IsOnCurve(x, y)\n}\n\n// Marshal converts a point given as (x, y) into a byte slice.\nfunc (curve btCurve) Marshal(x, y *big.Int) []byte {\n\tbyteLen := (curve.Params().BitSize + 7) / 8""}]}]",895a8597cb16c02203e38707ed2d1da5c500fe60,46bee92f9e64c0a06a12586a5d21cffc49d1ba8e
1465
1465
geth:ethereum-go-ethereum:GHSA-59hh-656j-3p7v,geth,ethereum-go-ethereum,GHSA-59hh-656j-3p7v,Medium,DoS via malicious snap/1 request,"### Impact
1466
1466
1467
1467
A vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer, via the `snap/1` protocol. The crash can be triggered by sending a malicious `snap/1` `GetTrieNodes` package.
Environment='JAVA_OPTS=""-Dlog4j2.formatMsgNoLookups=true""",https://github.com/Consensys/teku/security/advisories/GHSA-mwfw-vm54-g3p7,ethereum,2026-07-02T03:45:43Z,Other,N/A,"[""https://github.com/Consensys/teku/security/advisories/GHSA-mwfw-vm54-g3p7""]",,1.0,high,3,A_authoritative,consensus,p2p-interface,missing_input_validation,malformed_input,"[""CHANGELOG.md"", ""build.gradle"", ""gradle/versions.gradle""]","[{""file"": ""CHANGELOG.md"", ""hunks"": [{""start_line"": 1, ""code"": ""# Changelog\n\n## Released Changes\n### Breaking Changes\n- The commandline option `--network` of the `validator-client` subcommand introduces a new option value `auto`, which automatically\n fetches network configuration information from the configured beacon node endpoint. Other `--network` option values for an external validator client\n are now deprecated in favour of this option value (usage: `teku validator-client --network=auto`).\n- The default value for the `--network` commandline option of the `validator-client` command has changed from `mainnet` to `auto`.\n\n## Upcoming Breaking Changes\n- The `/teku/v1/beacon/states/:state_id` endpoint has been deprecated in favor of the standard API `/eth/v1/debug/beacon/states/:state_id` which now returns the state as SSZ when the `Accept: application/octet-stream` header is specified on the request.\n- The `/eth/v1/debug/beacon/states/:state_id` endpoint has been deprecated in favor of the v2 Altair endpoint `/eth/v2/debug/beacon/states/:state_id`""}, {""start_line"": 19, ""code"": ""\n## Unreleased Changes\n### Breaking Changes\n- Removed migration code from the old `ProtoArraySnapshot` based storage to the new format.\n Any node correctly following the Altair chain has already gone through this migration so no users should be affected by this.\n\n### Additions and Improvements\n- Introduces a new database format for archive nodes that significantly improves response times for queries that require historic state data.\n Existing databases and nodes using the default PRUNE storage mode are unchanged. Archive nodes wishing to take advantage of this will need to perform a full resync.\n- Docker images are now published with multi-arch support including Linux/amd64 and Linux/arm64 \n- The default docker image now uses JDK 17 instead of 16. The JDK 16 image is still available with the version suffix `-jdk16`\n- Include the date in output to console, when log files are not being written.\n- Reinstated the ignore rule for aggregate attestation gossip where the attestation root has been previously seen.\n- Added new metrics `executor_signature_verifications_queue_size`, `executor_signature_verifications_task_count`, \n `executor_signature_verifications_batch_count` and `executor_signature_verifications_batch_size` to give visibility \n into the remaining capacity of the signature verification process.\n- Added support for using the optimized BLST which is more efficient but does not support some older CPUs. \n On Linux and Mac Teku will attempt to detect if the CPU is compatible and automatically use the optimized version.\n On Windows or if auto-detection fails the portable version continues to be used.\n The version of BLST to use can be explicitly set by setting the `teku.portableBlst` system property. e.g `JAVA_OPTS=\""-Dteku.portableBlst=true\"" teku`\n\n### Bug Fixes\n - Generated head events will now send the slot of the latest block rather than the calculated head slot.""}]}, {""file"": ""build.gradle"", ""hunks"": [{""start_line"": 331, ""code"": "" // We shutdown log4j ourselves, as otherwise his shutdown hook runs before our own and whatever\n // happens during shutdown is not logged.\n \""-Dlog4j.shutdownHookEnabled=false\"",\n // run `jcmd <PID> VM.native_memory` to check JVM native memory consumption\n \""-XX:NativeMemoryTracking=summary\"",\n // 32Mb for Netty Direct ByteBuf""}]}, {""file"": ""gradle/versions.gradle"", ""hunks"": [{""start_line"": 96, ""code"": "" dependency 'commons-io:commons-io:2.11.0'\n dependency 'org.apache.commons:commons-compress:1.21'\n\n dependencySet(group: 'org.apache.logging.log4j', version: '2.13.3') {\n entry 'log4j-api'\n entry 'log4j-core'\n entry 'log4j-slf4j-impl'""}]}]","[{""file"": ""CHANGELOG.md"", ""hunks"": [{""start_line"": 1, ""code"": ""# Changelog\n\n## Upcoming Breaking Changes\n- The `/teku/v1/beacon/states/:state_id` endpoint has been deprecated in favor of the standard API `/eth/v1/debug/beacon/states/:state_id` which now returns the state as SSZ when the `Accept: application/octet-stream` header is specified on the request.\n- The `/eth/v1/debug/beacon/states/:state_id` endpoint has been deprecated in favor of the v2 Altair endpoint `/eth/v2/debug/beacon/states/:state_id`""}, {""start_line"": 12, ""code"": ""\n## Unreleased Changes\n### Breaking Changes\n\n### Additions and Improvements\n\n### Bug Fixes\n* Updated to latest log4j and disabled JNDI lookup support.""}]}, {""file"": ""build.gradle"", ""hunks"": [{""start_line"": 331, ""code"": "" // We shutdown log4j ourselves, as otherwise his shutdown hook runs before our own and whatever\n // happens during shutdown is not logged.\n \""-Dlog4j.shutdownHookEnabled=false\"",\n \""-Dlog4j2.formatMsgNoLookups=true\"",\n // run `jcmd <PID> VM.native_memory` to check JVM native memory consumption\n \""-XX:NativeMemoryTracking=summary\"",\n // 32Mb for Netty Direct ByteBuf""}]}, {""file"": ""gradle/versions.gradle"", ""hunks"": [{""start_line"": 96, ""code"": "" dependency 'commons-io:commons-io:2.11.0'\n dependency 'org.apache.commons:commons-compress:1.21'\n\n dependencySet(group: 'org.apache.logging.log4j', version: '2.15.0') {\n entry 'log4j-api'\n entry 'log4j-core'\n entry 'log4j-slf4j-impl'""}]}]",a52f376b7020b8554f3b9e3e7f54c4158f9bfa6c,7dd3378411aa42eca5904875b3b5b4f54dd252c4
14946
14946
20477e7159c2e375,besu,hyperledger/besu,CHANGELOG#b166a8611ccc7879,Info,Fix CVE-2026-34480 and CVE-2026-34478 in log4j [#10332](https://github.com/besu-eth/besu/pull/10332),"- `engine_newPayloadV3`/V4/V5: validate parameters before fork-support check so that missing required fields return `-32602` (`INVALID_PARAMS`) instead of `-38005` (`UNSUPPORTED_FORK`), matching the Engine API spec [#10249](https://github.com/besu-eth/besu/pull/10249)
14947
14947
- Fix data race in `SyncDurationMetrics` where the backing `HashMap` was mutated from multiple sync threads in parallel, causing missing or zero `sync_duration` samples. [#10277](https://github.com/besu-eth/besu/pull/10277)
14948
14948
- Fix chain pruning race that could lose fork block metadata updates when concurrent same-height block events are recorded. [#10331](https://github.com/besu-eth/besu/pull/10331)
erigon,sync,race_condition,malformed_input,Unrated,B_corroborated,added mutex lock to avoid race condition in downloader,https://github.com/erigontech/erigon/pull/5089
erigon,sync,race_condition,peer,Unrated,B_corroborated,Fix race condition in ProcessHeadersPOS,https://github.com/erigontech/erigon/pull/4151
210
-
geth,p2p,resource_exhaustion,malicious_p2p_message,High,A_authoritative,DoS via malicious p2p message,https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r
210
+
geth,crypto,resource_exhaustion,malicious_p2p_message,High,A_authoritative,DoS via malicious p2p message,https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r
211
211
geth,state-trie,consensus_divergence,crafted_state,Medium,A_authoritative,DoS via malicious snap/1 request,https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v
212
212
geth,evm,consensus_divergence,malicious_tx,High,A_authoritative,RETURNDATA corruption via datacopy,https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq
213
213
geth,transactions,consensus_divergence,crafted_state,High,A_authoritative,Consensus flaw during block processing,https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4
0 commit comments