CVE-2021-39137 — Interpretation Conflict in Ethereum Go-ethereum

CWE-436 — Interpretation Conflict6 documents5 sources
Severity
7.5HIGHNVD
CNA6.5
EPSS
0.3%
top 47.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Ethereum Go-ethereumEthereum GO EthereumEthereum Go-ethereum
Timeline
PublishedAug 24
Latest updateApr 16

Description

go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDethereum/go_ethereum1.10.0 — 1.10.8
▶Gogithub.com/ethereum_go-ethereum1.10.0 — 1.10.8+1
▶CVEListV5ethereum/go-ethereum>= 1.10.0, < 1.10.8

🔴Vulnerability Details

4
OSV
Consensus flaw during block processing in github.com/ethereum/go-ethereum↗2022-07-15
▶
OSV
Ethereum Contains Consensus Flaw During Block Processing↗2021-08-30
▶
GHSA
Ethereum Contains Consensus Flaw During Block Processing↗2021-08-30
▶
CVEList
Consensus flaw during block processing in go-ethereum↗2021-08-24
▶

📄Research Papers

1
arXiv
OpDiffer: LLM-Assisted Opcode-Level Differential Testing of Ethereum Virtual Machine↗2025-04-16
▶
CVE-2021-39137 — Interpretation Conflict | cvebase