Skip to main content
Back to Node Clients

Core-Geth

RecommendedGo

A go-ethereum derivative maintained for Ethereum Classic, released from the ethereumclassic community organization. The v1.12.x line went 21 months without security maintenance; Core-Geth v1.13.0, prepared by White B0x, fixes six CVEs, one of them exploited against ETC mainnet bootnodes in March 2026, and moves the client to Go 1.26.

Maintained in the community organizationReleases are published at ethereumclassic/core-gethLatest release →
DocumentationGitHub

Platform Support

WindowsmacOSLinuxDocker

Key Features

  • Snap and full sync, with archive mode
  • JSON-RPC, WebSocket and GraphQL APIs
  • EVM tracing and debugging
  • Built-in Etchash mining support
  • MESS (ECBP-1100) chain-selection defense, on by default
  • Build attestation on every release file

Upgrade from v1.12.x

Every v1.12.x release, including v1.12.23 from etclabscore/core-geth, carries at least one of the vulnerabilities below and was built on Go 1.21 or Go 1.22, whose support ended in August 2024 and February 2025. Upgrade to Core-Geth v1.13.0 or later from github.com/ethereumclassic/core-geth.

Download the latest release →Migration guide →

Fixed in v1.13.0

HIGH

CVE-2026-26313

P2P RLP item count memory exhaustion — crafted message header crashes node via OOM. Remote, no auth required.

Fix: 7a4988919

HIGH

CVE-2026-22862

ECIES decrypt length undercheck (off-by-15) — undersized RLPx auth payload causes out-of-bounds read and remote crash.

Fix: c46834dd8

HIGH

CVE-2026-26315

ECIES GenerateShared missing public key validation — MAC-oracle attack can leak P2P node key bits via repeated unauthenticated handshakes.

Fix: c19892395

HIGH

CVE-2026-26314

secp256k1 IsOnCurve field boundary bypass — out-of-field coordinates satisfy the naive curve equation and pass the validity gate.

Fix: c19892395

HIGH

CVE-2025-24883

UnmarshalPubkey missing IsOnCurve check — off-curve secp256k1 points pass deserialization and corrupt downstream crypto operations.

Fix: 681c915f0

MODERATE

CVE-2026-22868

KZG blob proof DoS — invalid proofs trigger full expensive verification without peer disconnect, enabling sustained CPU exhaustion.

Fix: 9985c33fb

MODERATE

GraphQL Depth DoS

No query depth limit on the --graphql endpoint, so one deeply nested query exhausts CPU and memory. v1.13.0 caps query depth at 20.

Fix: 6a046ee910

Upgrading to v1.13.0

  • No resync: chain data carries over.
  • Rotating the P2P node key is required, because CVE-2026-26315 leaks bits of it. With the node stopped, rename the key rather than deleting it. The node writes a new one on its next start, and its enode ID changes.
  • MESS (ECBP-1100) is on by default. Start with --mess=false to keep the v1.12.x behavior.
  • With no network flag, the node runs Ethereum Classic. --ethereum, --sepolia and --holesky refuse to start.
  • Ethereum Classic and Mordor nodes no longer open the Engine API port, 8551.
  • An empty --http.api or --ws.api list stops the node at startup.
mv <datadir>/geth/nodekey <datadir>/geth/nodekey.old-rotated-$(date +%F)

Migration guide for Linux, macOS, Windows and Docker →

v1.12.x security audit: status by release, CVE details, risk assessment, methodologyView audit →

Installation

Downloads for v1.13.0

Every file has a .sha256 and a build attestation beside it, and each archive has a core-geth-alltools counterpart that adds the developer tools. The binaries are not code-signed. v1.13.0 release notes →

Linux, x86_64

VERSION=v1.13.0
BASE=https://github.com/ethereumclassic/core-geth/releases/download/$VERSION
curl -LO $BASE/core-geth-linux-$VERSION.zip
curl -LO $BASE/core-geth-linux-$VERSION.zip.sha256
sha256sum -c core-geth-linux-$VERSION.zip.sha256
unzip core-geth-linux-$VERSION.zip
sudo install -m 0755 geth /usr/local/bin/geth
geth version

sha256sum -c must print OK. If it prints FAILED, delete the file and download it again. Full steps →

Linux, ARM

VERSION=v1.13.0
ARCH=arm64                # or: arm7, arm6, arm5
BASE=https://github.com/ethereumclassic/core-geth/releases/download/$VERSION
curl -LO $BASE/core-geth-$ARCH-$VERSION.zip
curl -LO $BASE/core-geth-$ARCH-$VERSION.zip.sha256
sha256sum -c core-geth-$ARCH-$VERSION.zip.sha256
unzip core-geth-$ARCH-$VERSION.zip
sudo install -m 0755 geth /usr/local/bin/geth
geth version

Set ARCH from what uname -m prints: aarch64 or arm64 is arm64, armv7l is arm7, armv6l is arm6, and armv5 is arm5. Full steps →

macOS

VERSION=v1.13.0
PLATFORM=osx-arm64        # or: osx, for Intel
BASE=https://github.com/ethereumclassic/core-geth/releases/download/$VERSION
curl -LO $BASE/core-geth-$PLATFORM-$VERSION.zip
curl -LO $BASE/core-geth-$PLATFORM-$VERSION.zip.sha256
shasum -a 256 -c core-geth-$PLATFORM-$VERSION.zip.sha256
unzip core-geth-$PLATFORM-$VERSION.zip
sudo install -m 0755 geth /usr/local/bin/geth
geth version

The binaries are not code-signed. A curl download is not quarantined; for a file a browser downloaded, run xattr -d com.apple.quarantine geth before starting it. Full steps →

Windows (PowerShell)

$VERSION = "v1.13.0"
$BASE = "https://github.com/ethereumclassic/core-geth/releases/download/$VERSION"
Invoke-WebRequest "$BASE/core-geth-win64-$VERSION.zip" -OutFile "core-geth-win64-$VERSION.zip"
Invoke-WebRequest "$BASE/core-geth-win64-$VERSION.zip.sha256" -OutFile "core-geth-win64-$VERSION.zip.sha256"
(Get-FileHash "core-geth-win64-$VERSION.zip" -Algorithm SHA256).Hash
Get-Content "core-geth-win64-$VERSION.zip.sha256"
Expand-Archive "core-geth-win64-$VERSION.zip" -DestinationPath .
.\geth.exe version

Compare the two hash lines yourself: the letters must match, the case does not. The binary is not code-signed, so Windows names its publisher as unknown. Full steps →

Verify where a download came from

gh attestation verify core-geth-linux-v1.13.0.zip --repo ethereumclassic/core-geth

A checksum proves only that the download is intact. The build attestation proves this repository's release workflow built the file. Use the archive you downloaded; the GitHub CLI is required. Full steps →

Docker

# The registry copies are not public yet, so take the image from the release:
curl -LO https://github.com/ethereumclassic/core-geth/releases/download/v1.13.0/core-geth-docker-amd64-v1.13.0.tar.gz
docker load -i core-geth-docker-amd64-v1.13.0.tar.gz

docker pull ghcr.io/ethereumclassic/core-geth:latest   # for when the registry is public

It is the same image and it keeps its published name, so nothing in your setup changes when the registry copy opens. Images are built for linux/amd64 and linux/arm64; on ARM, use the arm64 file. Run the container as the guide shows, which keeps JSON-RPC reachable from this host only. Full steps →

Build from source

git clone https://github.com/ethereumclassic/core-geth.git
cd core-geth
make geth
./build/bin/geth version

Building needs Go 1.26 and a C compiler. Do not clone with --recursive: the submodules hold test fixtures that make geth does not read. Full steps →

Configuration

Note: Run with --classic, or no network flag, for Ethereum Classic mainnet, and --mordor for the Mordor testnet.

Mainnet (Chain ID 61)

geth --classic

Mordor Testnet (Chain ID 63)

geth --mordor

Common Options

--http                     # JSON-RPC on 127.0.0.1:8545, this machine only
--http.api eth,net,web3    # Serve only these namespaces
--ws                       # WebSocket on 127.0.0.1:8546
--syncmode full            # Execute every block from genesis; snap is the default
--gcmode archive           # Keep the state of every block, for an archive node
--mine --miner.etherbase <address>   # Solo mining with your own hardware

Keep --http.addr on 127.0.0.1 unless a trusted proxy sits in front of the node, and keep admin, debug and personal out of --http.api on any reachable interface. RPC exposure → Flags for each kind of node →

Actively Maintained

This client is actively developed and receives regular updates.

Need Help Getting Started?

Check out our network information page for RPC endpoints and testnet resources.

Network InfoTestnet Faucets