Core-Geth v1.12.x Security Audit

Summary

Upgrade to Core-Geth v1.13.0 or Later, and Rotate Your Node Key

Core-Geth went 21 months without security maintenance, from v1.12.20 in June 2024 to the emergency releases of March 2026. Six CVEs and a GraphQL denial of service accumulated in that window. Two of them, CVE-2026-22862 and CVE-2026-26315, were exploited against the Ethereum Classic mainnet bootnodes on 18 March 2026, where one bootnode crash-looped through more than 805 restarts before a patch reached it.

The three releases cut in response did not close the line. Every v1.12.x build, v1.12.23 included, still carries at least one unpatched CVE and still serves the GraphQL endpoint with no query depth limit, and every published archive was built on a Go release that had already left support. The v1.12.21 archives also raised the Linux glibc floor, so an operator on Ubuntu 20.04, Debian 11, RHEL 8 or Amazon Linux 2 could not run the security release they were told to install.

Core-Geth v1.13.0, released from ethereumclassic/core-geth on 14 September 2026, fixes every finding and is built with Go 1.26.8, with no Go standard library advisory reported against its archives. Run the current release; a node tracking the previous repository will not see it. Rotate the P2P node key as you upgrade rather than merely considering it: CVE-2026-26315 is an oracle against that key, so a key used by an unpatched node should be treated as exposed. Rename the key file rather than deleting it, and expect the enode ID to change.

Background

How This Was Found

During cross-client testing, the Ethereum Classic core developers found that etclabscore/core-geth, then the primary Ethereum Classic execution client, had received no security maintenance since its v1.12.20 release in June 2024. Six CVEs and a GraphQL depth-limit denial of service had accumulated unpatched, and every binary was built on Go 1.21 or Go 1.22, whose support ended in August 2024 and February 2025.

Private disclosures sent to that repository in 2025 received no response. Neither did the community pull requests that named the vulnerabilities in public, one of which linked the advisory for CVE-2025-24883 in June 2025, nor the public disclosure by a Ledger security researcher in February 2026. An attack on ETC bootnodes in March 2026 was what produced the emergency v1.12.21 and v1.12.22 releases, which backported some of the CVE fixes onto the same end-of-life toolchain and left the rest open. The ETC Cooperative, which controls that repository, had entered maintenance mode at the end of 2024 and published that maintenance of the client would fall to other stakeholders.

The full remediation began in February 2026 and was published at ethereumclassic/core-geth, the community repository created in December 2024. Those pull requests, filed in the repository the client had moved to, stayed open for five and a half months.

The previous repository went on publishing over the same period. Its first maintainer response to the February disclosure is dated 18 March 2026, the day the attack began, and three further releases followed: v1.12.21 merged 70 minutes after it opened, v1.12.22 in under two minutes, and v1.12.23 in August, none of them carrying a recorded review.

The community repository's work reached operators as Core-Geth v1.13.0 on 14 September 2026, from code that had been public since February.

March 2026

The March 2026 Attack on Core-Geth v1.12.x Nodes

On 18 March 2026, the ECIES handshake path was actively exploited against the ETC mainnet classic bootnodes ams3 and sfo3. Two defects in that path were reachable by any unauthenticated peer: CVE-2026-22862, the decrypt length undercheck (CVSS 7.5 High, GHSA-mr7q-c9w9-wh4h), and CVE-2026-26315, the invalid-curve key oracle in GenerateShared (CVSS 5.9 Medium, GHSA-m6j8-rg6r-7mv8). Malicious P2P traffic sent crafted auth messages with undersized ECIES payloads, crashing each node on inbound handshake attempts. Because the crash occurred in listenLoop, the node process exited and restarted under the service manager — only to crash again on the next malicious connection, producing an automated crash-loop. Bootnode sfo3 accumulated 805+ restart cycles on v1.12.20 before the patch was deployed.

panic: runtime error: makeslice: len out of range

goroutine 42797 [running]:
github.com/ethereum/go-ethereum/crypto/ecies.symDecrypt(...)
        crypto/ecies/ecies.go:224
github.com/ethereum/go-ethereum/crypto/ecies.(*PrivateKey).Decrypt(...)
        crypto/ecies/ecies.go:322
github.com/ethereum/go-ethereum/p2p/rlpx.(*handshakeState).readMsg(...)
        p2p/rlpx/rlpx.go:612
github.com/ethereum/go-ethereum/p2p/rlpx.(*handshakeState).runRecipient(...)
        p2p/rlpx/rlpx.go:415
github.com/ethereum/go-ethereum/p2p/rlpx.(*Conn).Handshake(...)
        p2p/rlpx/rlpx.go:308
github.com/ethereum/go-ethereum/p2p.(*Server).listenLoop.func2()
        p2p/server.go:921

Stack trace from issue #692. PR #694 (v1.12.21), which cherry-picked the fix for both defects, was opened and merged by its author 70 minutes later, with no review, and the release followed about five hours after the crash was first reported: the first code activity from the upstream maintainer in 14 months.

Timeline

Release Timeline

What Operators Need to Do

Status by Release

The findings apply to every release in the v1.12.x line, including the most recent. If you run any of them, upgrade to Core-Geth v1.13.0 or later and rotate your node key, as the migration guide describes.

The v1.12.22 release notes attach CVE-2026-26315, which v1.12.21 had already fixed, to the fix for CVE-2026-26314, so matching those notes against the advisory records shows CVE-2026-26314 as unaddressed when it shipped in v1.12.22. The v1.12.21 and v1.12.23 release notes carry no advisory identifiers.

The August 2026 follow-up measures v1.12.23 at its tag and reconciles every identifier →

Shares are of the 524 Core-Geth nodes seen on etcnodes.org on 17 September 2026, of 550 nodes in total. A further four report v1.12.24, which is a development build of the previous repository's master branch rather than a release. These figures move, and etcnodes.org carries the current breakdown.

CVE Analysis

CVE Gap Analysis

The following vulnerabilities were present in etclabscore/core-geth at v1.12.20. All are fixed in Core-Geth v1.13.0.

The March 2026 audit carries the per-CVE analysis and the disclosure timeline →

Go Toolchain

Go Runtime End-of-Life

Each v1.12.x release was built by two toolchains, not one. The Linux and macOS archives, and the Windows archives from v1.12.21, were built with Go 1.21; every Arm archive, and v1.12.20's Windows archive, was built with Go 1.22. Go's release policy provides security patches only for the two most recent major versions, so support ended in August 2024 for Go 1.21 and February 2025 for Go 1.22. As of the March 2026 audit, Go 1.21 had been unsupported for 19 months, leaving the standard library (net/http, crypto/tls, crypto/x509) unpatched across that window. Core-Geth measured each published archive: every v1.12.20 to v1.12.23 archive carries 55 to 61 Go standard library advisories that v1.13.0 does not.

Core-Geth v1.13.0 at ethereumclassic/core-geth is built with Go 1.26.8, and a scan of its archives reports no Go standard library advisory at all. The v1.12.x source cannot simply be rebuilt on a supported Go: its release build stops in blst v0.3.11 from Go 1.24, and at the linker in fjl/memsize from Go 1.23. v1.13.0 carries blst v0.3.17, no memsize, and go 1.26.0 in its module file. Commit: b7d164018. The Go toolchain audit lists every advisory and how each archive was measured.

Artifacts

What the Published Archives Contain

A release is what the archive contains, not what the build configuration says it builds, and the two can disagree for a long time without anything reporting it. The build succeeds, the tests pass, the archive is well formed and the checksum matches. Core-Geth measured the published archives by opening them.

The Linux platform floor moved without being announced. v1.12.20 required GLIBC_2.17; v1.12.21 raised it to GLIBC_2.34and v1.12.22 and v1.12.23 held it there. glibc 2.34 merged libpthread and libdl into libc, so a binary linked against it acquires that whole symbol family at that version, and no change in the source causes it. Ubuntu 20.04, Debian 11, RHEL and Rocky 8, and Amazon Linux 2 all ship older glibc. An operator on any of them could run v1.12.20 and could not run the security release they were told to upgrade to. Every Arm archive moved the same way in the same release.

The macOS archive changed architecture under a fixed name. core-geth-osx-<version>.zip carried an x86_64 binary at v1.12.19 and an Apple Silicon binary from v1.12.20 onward, under a name that records no architecture. An Intel Mac user following the same download path as always receives a binary their machine cannot execute, and the failure appears when they run it rather than when they download it.

v1.13.0 states the platform floor as a build input and fails the release when an artifact does not meet it, restoring GLIBC_2.17 on x86_64 and each Arm target to the floor v1.12.20 shipped. It publishes both macOS architectures under names that say which is which, and every archive and image carries a checksum and a build attestation.

The release-artifact audit lists every measurement and how each archive was read →

Risk Assessment

Risk Assessment

Evidence Trail

Postmortem: Public Evidence Trail

The following issues, pull requests and releases at etclabscore/core-geth and the community repository form a linkable evidence trail. Each entry before the attack was a missed opportunity to prevent it; the last two record how the v1.12.x line ended and where the findings were resolved.

Root Cause

Structural Failures

Five independent structural failures — any one of which, if addressed, would have been sufficient to prevent the March 2026 attack.

Attribution

Maintainers

Core-Geth is a fork of multi-geth, originally created and maintained by Wei Tang (@sorpaas). Multi-geth was the first multi-network go-ethereum fork with first-class ETC support, and its chain configuration architecture is the direct ancestor of core-geth.

The core-geth fork was then developed by ETC Labs until they left the ETC ecosystem in 2021. ETC Cooperative-paid staff maintained the client through the Spiral hard fork up until announcing maintenance mode for the client in December 2024:

• Isaac Ardis (@meowsbits) — primary architect and long-term maintainer
• Diego López León (@diega) — release manager; cut the v1.12.20 release
• Chris Ziogas (@ziogaschr) — contributor and maintainer

Current

The client is maintained in the ethereumclassic organization by the @ethereumclassic/core-developers team, which 85d68471d names as code owners across the consensus, networking, CI, licensing and documentation paths. Naming a team rather than an account is what keeps a reviewer available when any one person is not, which is the failure this report documents.

Upgrade

Upgrade Path

Core-Geth is maintained in the ethereumclassic organization, and that is where its releases are published. Run the current release and track that repository: a node watching the previous one will not see it.

If you run any v1.12.x release, upgrade to Core-Geth v1.13.0 or later and rotate your node key. Every v1.12.x release, v1.12.23 included, carries at least one unpatched CVE and was built on a Go version that left support in August 2024 or February 2025. The migration guide covers Linux, macOS, Windows and Docker, and needs no resync.

Defaults

What Else Changed in v1.13.0

Two defaults changed with this release, for different reasons. One is a security posture taken against the state of the network these audits measured. The other follows from the condition behind the CVE gap itself: services the network relied on were run by one organization, whose board has communicated that it is winding down.

The v1.13.0 release report covers every change and how to verify a download →

Recommendations

Recommendations

Methodology

Methodology and Scope

The audit began during cross-client interoperability testing. It targeted etclabscore/core-geth at tag v1.12.20 (commit c2fb44129), cross-referenced against the go-ethereum security advisory database and the Go vulnerability database (vuln.go.dev). Each advisory was assessed by tracing the code core-geth shares with go-ethereum. Exploitability was confirmed for CVE-2026-22862, which was exploited; for the others, reachability from unauthenticated network input was established by reading the affected call paths. Fixes were cherry-picked from go-ethereum where possible, and ported by hand for CVE-2026-26313 and CVE-2026-26314, where the code had diverged. Tools: govulncheck, manual code review, the go-ethereum advisory database and vuln.go.dev.

Every patch was validated on the Mordor testnet: sync resuming after the patch, P2P handshake stability under normal peer traffic, unchanged JSON-RPC responses from eth_syncing, eth_blockNumber and net_peerCount, and block processing against known Mordor block hashes.

References

References

• Core-Geth v1.13.0 release notes
• Core-Geth v1.13.0 release report
• v1.13.0: the record behind the release, answering published claims from commit metadata, pull requests and release files
• MESS: what v1.13.0 defaults to, and the trade-off per operator
• Migrating to v1.13.0
• March 2026 security audit: the six CVEs, per release, with the disclosure timeline
• September 2026 release-artifact audit: what the published archives contain, measured by opening them
• August 2026 security follow-up, covering v1.12.23
• Dependency and toolchain modernization
• Go toolchain: which toolchain built each archive, and the advisories each one carries
• The ETC Cooperative transition: where each service continues
• Release artifacts audit
• Reporting a vulnerability: SECURITY.md
• Security contact for pools, exchanges and service providers: security@ethereumclassic.com
• etclabscore/core-geth: the previous repository and the v1.12.x releases
• go-ethereum GitHub Security Advisories
• Go Vulnerability Database — vuln.go.dev
• ETC Node Clients
• Client Implementations
• ECIP-1112: Sovereignty Vault (draft) — where base-fee revenue would accumulate