CVE-2018-20421: Ethereum Go Ethereum

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly { mstore }" followed by a "c[0xC800000] = 0xFF" assignment.

Affected products

• Ethereum Go Ethereum: version 1.8.19 only

Published 2018-12-24. Last modified 2026-06-17.