What the network is running, in figures
Nodes measured
524
Core-Geth nodes seen on September 17, 2026, counted by etcnodes.org.
On a vulnerable release
97.5%
511 nodes running a release with a client CVE still open.
On the v1.13 line
1.7%
9 nodes running the line with every client CVE patched.
Audits and reports
7
Five audits covering the v1.12 line and the work that replaced it, and two v1.13 release reports.
Core-Geth security and provenance
How Ethereum Classic Core Developers Fixed Core-Geth
The dormancy
Core-Geth v1.12 to v1.13 Go toolchain audit →
The last stable release from
etclabscore/core-gethwasv1.12.20, before 21 months of dormancy, through which contributors' issues and pull requests went unmerged. The emergency releases that eventually followed were still built on Go versions no longer supported. Go is compiled into the binary rather than loaded when it runs, so each emergency release carries 62 known Go security flaws for as long as the node is up, and nothing short of a new build removes those flaws.The attack
Core-Geth v1.12 security audit →
One of the flaws left unpatched through the gap was used against Core-Geth
v1.12bootnodes in March 2026, in an attack on that line. Ethereum Classic core developers had resumed maintenance inethereumclassic/core-geththe month before and had disclosed the fixes privately to theetclabscore/core-gethmaintainers, who cut the emergencyv1.12.21andv1.12.22releases from that work while thev1.13line was built and tested inethereumclassic/core-gethfor the network to move to.The solution
Core-Geth v1.13.0 release report →
Download Core-Gethv1.13.0, published fromethereumclassic/core-geth, fixes every client CVE the audits found in thev1.12client code, bounds GraphQL queries, carries neitherv1.12regression, and returns the dependencies and the Go toolchain to supported versions.
The Core-Geth release record
Every Release Since the Gap, Newest First
The 21 months between June 2024 and February 2026 are the gap. This runs from the release that ended the gap back to the last release before it, and each release names the repository that published it: what etclabscore/core-geth cut as an emergency patch, and what was built, tested and released in ethereumclassic/core-geth. Every release in this timeline but the first is still vulnerable, and each entry says what it left open.
v1.13.0fromethereumclassic/core-gethAbout six months of work, tested on Ethereum Classic mainnet and Mordor throughout, from February 2026: every client CVE the audits found in the
v1.12client code closed, GraphQL queries bounded, neitherv1.12regression, and a supported Go toolchain.ethereumclassic/core-gethhas several maintainers with admin access and takes pull requests from anyone, which the single-author emergency releases inetclabscore/core-gethdid not have.Bootnodes and peer discovery move to this organization
A node finds its first peers through bootnodes and the peer discovery lists.
ethereumclassic/discv4-dns-lists →ethereumclassic/discv4-dns-listswas created on August 28, 2026 to publish those lists from theethereumclassicorganization, the first trees were published on September 10, 2026, andv1.13.0ships with three Ethereum Classic and two Mordor bootnodes run by the Core-Geth maintainers and reads the new lists by default.v1.12.23frometclabscore/core-gethThe last release from
etclabscore/core-geth, and still not one to run today. It closed CVE-2026-26313 by hardening how peer messages are decoded, and left the rest open: one client CVE unpatched, GraphQL queries unbounded, theeth_syncingregression and the Go toolchains out of support. It also added a regression of its own, a snap storage-range cap that can disconnect peers answering correctly.v1.12.22frometclabscore/core-gethetclabscore/core-gethcut this release 95 seconds after its pull request opened, again with no reviewer recorded. It backported two more CVE fixes from the same privately reported work and left two client CVEs open: one mitigated rather than fixed, so a peer can still exhaust a node's CPU on a message that node will reject, and one never addressed at all, having been declared not applicable to Ethereum Classic. The Go toolchains were unchanged and out of support, and GraphQL queries still unbounded. It also introduced a regression ineth_syncing: a node reports the wrong network head, which misleads the exchanges, explorers and monitoring that read it to decide whether that node has finished syncing.The fixes are published in
ethereumclassic/core-geth27 pull requests, #10 to #36, each scoped to a single change: a fix for each of the six CVEs, with a test and a linked advisory, plus the Go toolchain upgrade and the rebuilt release pipeline. Everything the rest of this page measures has been public since March 2026.
v1.12.21frometclabscore/core-gethetclabscore/core-gethcut this release about five hours after the attack was reported, from the patches Ethereum Classic core developers had disclosed privately. It closed the exploited crash and the key oracle alongside it and capped the size of a handshake message, left four known CVEs open, and introduced no regression. Its Go toolchains were unchanged and out of support, GraphQL queries still unbounded, and its notes did not tell operators to rotate the node key the oracle had exposed. Its release pull request was opened and merged by a single account in about 70 minutes, with no reviewer recorded.The bootnode attack on the Core-Geth
v1.12lineA flaw left open through the gap was used against Core-Geth
v1.12bootnodes in production in March 2026: a handshake crash loop that panics the node on a malformed message. A second flaw patched in the same emergency release, an oracle that leaks bits of a node's P2P key across repeated handshakes, played no part in the attack. It is the reason a node that ran thev1.12line must rotate its P2P key. Every release published before March 18, 2026 carries both flaws.Maintenance resumes in
ethereumclassic/core-gethEthereum Classic core developers began work on the next release line in
ethereumclassic/core-geth: the outstanding CVEs patched, a supported Go toolchain, the release pipeline rebuilt. The first patch was authored on February 26, and the line was tested on Ethereum Classic mainnet and Mordor from then until release. They are the stakeholders the Cooperative's retrospective had left the client's maintenance to.RETROSPECTIVE
“it will be up to other stakeholders to take on any required maintenance of the ETC client”
ETC Cooperative, 2024, ETC Cooperative 2024 retrospective The Ethereum Classic DAO is formed
The Ethereum Classic DAO took up Core-Geth's maintenance in February 2026 as the funder of last resort, with Ethereum Classic's core developers and open community contributions doing the day-to-day work.
ethereumclassicdao.org →Maintenance moves to
ethereumclassic/core-geth
The commit it was created from →ethereumclassic/core-gethwas created from the previous repository's commit of December 16, 2024, the move the ETC Cooperative's own roadmap of July 2024 had proposed. No stakeholder took the maintenance up until February 2026, which is why the gap runs as long as it does.v1.12.20frometclabscore/core-gethThe last stable release from
etclabscore/core-gethbefore a 21-month gap in security maintenance, from June 2024 to February 2026. Every client CVE the audits found is unpatched in it, including the one later used against the bootnodes, and GraphQL queries are unbounded. Its Go toolchains, Go 1.21 and Go 1.22, left support in August 2024 and February 2025. The last commit of any kind in that repository was a dependency bump in January 2025, and the private security disclosures sent to it through 2025 got no response.
Ethereum Classic nodes
Most Ethereum Classic Nodes Are Running a Vulnerable Release
The v1.13 line patches every client CVE the audits found in the v1.12 client code, bounds GraphQL queries, carries neither the eth_syncing regression nor the snap storage-range regression of the last v1.12 releases, and is built with a supported Go version. As a best practice, first run one v1.13 node on a machine of its own beside your current ones, with no RPC clients or miners pointed at it. Once it has caught up with the network and holds peers, move your whole fleet to the v1.13 line.
v1.13.0recommended9 nodes · 1.7%every client CVE patched, a supported Go toolchain, GraphQL queries bounded, about six months of testing on Ethereum Classic mainnet and Mordor from February 2026 until release, the security work the v1.12.21 and v1.12.22 emergency releases were cut from
What v1.13.0 carries
- Issues fixed
- All six client CVEs the audits found in the
v1.12client code, each patched with a test: CVE-2026-22862, the handshake crash used against Core-Gethv1.12bootnodes in March 2026; CVE-2026-26315, the node key oracle; CVE-2025-24883 and CVE-2026-26314, two missing public key checks; CVE-2026-26313, peer message memory exhaustion; and CVE-2026-22868, the blob proof denial of service. GraphQL query depth is limited. - Unaddressed issues
- Nothing the 2026 audits found.
- Added regressions
- Neither
v1.12regression carries over. Both arrived in releases cut inetclabscore/core-geth:eth_syncingbroke inv1.12.22, and the snap storage-range cap arrived inv1.12.23. - Supported toolchain
- Built with go1.26.8, the newest Go 1.26 release when
v1.13.0was cut, with no Go standard library advisory against it that day. Go 1.26 is in support and receives the Go team's security fixes, and eachv1.13release is cut with the newest patch of its Go version. - Source of the fixes
- Ethereum Classic core developers wrote these fixes and the Go toolchain upgrade for the
v1.13line from February 2026, and reported the work privately to theetclabscore/core-gethmaintainers in February and March 2026. The emergency releasesv1.12.21andv1.12.22were cut from that work, and the same fixes were published inethereumclassic/core-gethas pull requests #10 to #36 on March 20 and 21, 2026. - Known issues
- Listed in the release report for
v1.13.0, under Known issues.
v1.12.23vulnerable138 nodes · 26.3%1 client CVE open, unsupported Go toolchain, 62 known Go flaws with 48 in the binary, GraphQL queries unbounded, eth_syncing regression, snap storage-range cap regression
What v1.12.23 carries
- Issues fixed
- CVE-2026-22862, the handshake crash used against Core-Geth
v1.12bootnodes in March 2026; CVE-2026-26315, the node key oracle, though a node that kept the key it ran onv1.12.20or older is still running an exposed one; CVE-2025-24883 and CVE-2026-26314, two missing public key checks; and CVE-2026-26313, peer message memory exhaustion, which this release finishes by hardening how peer messages are decoded. - Unaddressed issues
- CVE-2026-22868, a denial of service in blob proof checks, not reached on Ethereum Classic and active on the Ethereum mainnet, Sepolia and Holesky configurations this binary also ships. GraphQL queries can nest without limit, which can exhaust a node that serves GraphQL; the endpoint is off unless
--graphqlis set. Theeth_syncingregression carried fromv1.12.22stays: a node reports the wrong network head, which misleads the exchanges, explorers and monitoring that read it to decide whether that node has finished syncing. Its report,etclabscore/core-gethissue #697, is still open. - Added regressions
- A cap on snap sync storage-range responses that can disconnect peers answering correctly, measured in the August 2026 follow-up.
- Unsupported toolchain
- Built with go1.21.13, and go1.22.1 for the Arm archives. Go 1.21 left support in August 2024 and Go 1.22 in February 2025, before this release shipped, so no Go security fix will reach its binaries. Its archives carry 62 Go standard library advisories, 48 of them in code compiled into the binary, and that count only rises; whether a node can reach that code was not assessed.
v1.12.22vulnerable165 nodes · 31.5%1 client CVE open and 1 partially mitigated, unsupported Go toolchain, 62 known Go flaws with 48 in the binary, GraphQL queries unbounded, eth_syncing regression
What v1.12.22 carries
- Issues fixed
- CVE-2026-22862, the handshake crash used against Core-Geth
v1.12bootnodes in March 2026; CVE-2026-26315, the node key oracle, though a node that kept the key it ran onv1.12.20or older is still running an exposed one; and CVE-2025-24883 and CVE-2026-26314, two missing public key checks, which this release adds. It also stops the out-of-memory crash in CVE-2026-26313, peer message memory exhaustion, a partial fix its own commit calls a mitigation. This release was cut from the security work Ethereum Classic core developers reported privately for thev1.13line. - Unaddressed issues
- The rest of CVE-2026-26313: a peer can still make the node spend CPU on a message it will reject. CVE-2026-22868, a denial of service in blob proof checks, which
etclabscore/core-gethdeclared not applicable to Ethereum Classic and left unpatched: the flaw is not reached on Ethereum Classic and is active on the Ethereum mainnet, Sepolia and Holesky configurations this binary also ships. GraphQL queries can nest without limit, which can exhaust a node that serves GraphQL; the endpoint is off unless--graphqlis set. - Added regressions
- The
eth_syncingregression: a node reports the wrong network head, which misleads the exchanges, explorers and monitoring that read it to decide whether that node has finished syncing. Its report,etclabscore/core-gethissue #697, is still open. - Unsupported toolchain
- Built with go1.21.13, and go1.22.1 for the Arm archives. Go 1.21 left support in August 2024 and Go 1.22 in February 2025, before this release shipped, so no Go security fix will reach its binaries. Its archives carry 62 Go standard library advisories, 48 of them in code compiled into the binary, and that count only rises; whether a node can reach that code was not assessed.
v1.12.21vulnerable50 nodes · 9.5%4 client CVEs open, unsupported Go toolchain, 62 known Go flaws with 48 in the binary, GraphQL queries unbounded
What v1.12.21 carries
- Issues fixed
- CVE-2026-22862, the handshake crash used against Core-Geth
v1.12bootnodes in March 2026, and CVE-2026-26315, the node key oracle, though a node that kept the key it ran onv1.12.20or older is still running an exposed one. It also caps the size of a handshake message. This release was cut from the security work Ethereum Classic core developers reported privately for thev1.13line. - Unaddressed issues
- CVE-2025-24883 and CVE-2026-26314, two missing public key checks; CVE-2026-26313, peer message memory exhaustion; and CVE-2026-22868, a denial of service in blob proof checks, not reached on Ethereum Classic and active on the Ethereum mainnet, Sepolia and Holesky configurations this binary also ships. GraphQL queries can nest without limit, which can exhaust a node that serves GraphQL; the endpoint is off unless
--graphqlis set. - Added regressions
- None:
eth_syncingbroke inv1.12.22, and the snap storage-range cap arrived inv1.12.23. - Unsupported toolchain
- Built with go1.21.13, and go1.22.1 for the Arm archives. Go 1.21 left support in August 2024 and Go 1.22 in February 2025, before this release shipped, so no Go security fix will reach its binaries. Its archives carry 62 Go standard library advisories, 48 of them in code compiled into the binary, and that count only rises; whether a node can reach that code was not assessed.
v1.12.20 and oldervulnerable158 nodes · 30.2%6 client CVEs open, unsupported Go toolchain, 62 known Go flaws with 48 in the binary, GraphQL queries unbounded
What v1.12.20 and older carries
- Issues fixed
- Nothing the 2026 audits found.
- Unaddressed issues
- All six client CVEs: CVE-2026-22862, the handshake crash used against Core-Geth
v1.12bootnodes in March 2026; CVE-2026-26315, the node key oracle, which is why a node that ran one of these releases must rotate its P2P key; CVE-2025-24883 and CVE-2026-26314, two missing public key checks; CVE-2026-26313, peer message memory exhaustion; and CVE-2026-22868, a denial of service in blob proof checks, not reached on Ethereum Classic and active on the Ethereum networks the client also ships. GraphQL queries can nest without limit, which can exhaust a node that serves GraphQL; the endpoint is off unless--graphqlis set. - Added regressions
- None:
eth_syncingbroke inv1.12.22, and the snap storage-range cap arrived inv1.12.23. - Unsupported toolchain
v1.12.20was built with go1.21.10, and go1.22.1 for the Windows and Arm archives, each already behind its newest patch the day it shipped. Go 1.21 left support in August 2024 and Go 1.22 in February 2025, so no Go security fix will reach these binaries. Thev1.12.20archives carry 62 Go standard library advisories, 48 of them in code compiled into the binary, and that count only rises; whether a node can reach that code was not assessed. Earlierv1.12releases were built with Go 1.13 to Go 1.22, and none of those Go versions is supported today.
Core-Geth nodes by release on , 524 in all. Source: etcnodes.org. The 4 nodes not listed above ran a development build of the previous repository's master, which is not a release. The evidence for each row · Where the Go figures come from
The Core-Geth v1.12 security audit
Vulnerability Summary
The six client CVEs and the GraphQL denial of service the March 2026 audit found in the v1.12 client code, and what each line did about them. The audit carries the detail of each one.
| CVE | Severity | Component | etclabscore/core-geth | v1.13.0 (ethereumclassic) |
|---|---|---|---|---|
| CVE-2025-24883 | High | crypto: secp256k1 key deserialization | Backported in v1.12.22 | Patched |
| CVE-2026-22862 | High | crypto/ecies: ECIES decrypt length check | Backported in v1.12.21 | Patched |
| CVE-2026-26315 | Medium | crypto/ecies + secp256k1: ECIES GenerateShared / IsOnCurve | Backported in v1.12.21 | Patched |
| CVE-2026-26314 | High | crypto/secp256k1: coordinate field boundary bypass | Backported in v1.12.22 | Patched |
| CVE-2026-22868 | Medium | txpool / P2P: KZG DoS (blob/KZG proof verification) | Declared N/A to ETC ¹ | Patched (peer disconnect on invalid proof) |
| CVE-2026-26313 | High | P2P: RLP item count memory exhaustion | Mitigated in v1.12.22 ² | Patched |
| GraphQL depth | Medium | RPC: unbounded query nesting DoS | Not addressed | Patched |
¹ etclabscore/core-geth declared CVE-2026-22868 not applicable to Ethereum Classic, because Ethereum Classic does not support EIP-4844 blob transactions. That holds for the Ethereum Classic network, but the v1.12.x line also ships the Ethereum mainnet, Sepolia and Holesky configurations, where EIP-4844 and the KZG path are active, so the finding applies to a supported configuration of the client. The v1.13.0 patch implements the go-ethereum fix and refuses those three networks, with --mainnet selecting Ethereum Classic.
² Both mitigations prevent the out-of-memory crash by refusing to allocate per declared item, and neither avoids scanning the payload, so a peer can still spend CPU proportional to message size on a message that will be rejected. The bound comes from a static item ceiling in v1.12.22 and from the pending request in v1.13.0.
Read the etclabscore/core-geth column by release, not as a single verdict: "Backported in v1.12.22" means the fix is present in v1.12.22 and later. No v1.12.x release, v1.12.23 included, closes every finding; the v1.13 line does. The August 2026 follow-up gives the full per-release matrix.
The Core-Geth v1.12 audits
Everything the 2026 Core-Geth v1.12 Audits Found, Published in Full
These five examine the v1.12 line and the work that replaced it: that line's client code, the Go toolchain its binaries inherit, its dependency tree, and the archives it published. If you run a node, read these reports with your security engineers: each one carries its method and its raw measurements, so you can verify every claim and judge what running v1.12 exposed you to.
Core-Geth v1.12 security audit →
What 21 months without security maintenance in
etclabscore/core-gethleft open in the v1.12 client code, and the March 2026 attack that used one of those flaws against Core-Gethv1.12bootnodes. It names which releases carry each flaw.Core-Geth v1.12 security follow-up →
v1.12.23Argos is real security work and an improvement on the rest of the v1.12 line, and still not safe to run: one client CVE unpatched, GraphQL queries unbounded, theeth_syncingregression fromv1.12.22, a snap storage-range cap of its own that can disconnect peers answering correctly, and Go toolchains out of support. Only the v1.13 line clears every one of those findings, and a node that ran v1.12 needs a new P2P key.Core-Geth v1.12 to v1.13 dependency modernization →
What the maintenance gap left behind in the v1.12 line: a module graph that had not moved since December 2024, and Go toolchains already out of support. The v1.13 line moved that module graph onto a supported Go with 83 module changes, and the report records why each version was chosen.
Core-Geth v1.12 to v1.13 release pipeline audit →
Nobody was checking what the v1.12 releases contained until the v1.13 work opened their archives. The Linux glibc floor rose across three v1.12 releases unobserved, their macOS archive ships a binary most of its downloaders cannot run, and no v1.12 archive is signed or attested.
Core-Geth v1.12 to v1.13 Go toolchain audit →
Every v1.12 binary carries the security flaws of the Go version it was built with, and those toolchains left support in 2024 and 2025. Only a rebuild on a supported Go removes those flaws, and the v1.12 source does not build on one. The v1.13 line is built on a supported Go, and each of its releases is cut with the newest patch of that Go version.
The Core-Geth v1.13 release
What the Core-Geth v1.13 Line Fixes, and How to Check Each Claim
The v1.13 line closes every client CVE the audits found in the v1.12 client code, including the one used against Core-Geth v1.12 bootnodes in March 2026 and the one etclabscore/core-geth declared not applicable to Ethereum Classic, and it bounds the GraphQL query nesting that line left unlimited. It carries neither regression etclabscore/core-geth introduced, the eth_syncing regression from v1.12.22 or the snap storage-range cap from v1.12.23. It is built with a supported Go toolchain, and the dependency tree behind it was modernized in the same work. It reads peer discovery lists published from the ethereumclassic organization, ships bootnodes run by the Core-Geth maintainers, and is cut by a rebuilt release pipeline that gives each archive a checksum and a build attestation binding it to the workflow run that produced it. Every node still on a v1.12 release should move to the v1.13 line. Migrate Core-Geth has the steps for each platform, including the required P2P node key rotation.
A v1.12 node that cannot move yet can read the peer discovery lists and bootnodes the v1.13 line ships, a small step that closes none of the flaws the audits found in the v1.12 line.
Core-Geth v1.13.0 release report →
What v1.13.0 fixes, what it changes, how to verify a download, and what is known to be imperfect in it.
Core-Geth v1.13.0: the record behind the release →
Every claim made about v1.13.0 answered from the public record: commit metadata, pull requests, release files and advisory databases.
How disclosure was handled
The fixes were disclosed before they were published
Ethereum Classic core developers wrote the patches, reported them privately to the etclabscore/core-geth maintainers in February and March 2026, and published them in ethereumclassic/core-geth as 27 individually scoped pull requests on March 20 and 21, 2026. etclabscore/core-geth cut its emergency releases on March 18 and 28, 2026 from those patches.
Others had tried to get the same problems fixed there first, and the record of those attempts is public. Private security disclosures sent to etclabscore/core-geth through 2025 got no response, and so did a public issue a security researcher at Ledger opened in February 2026 naming three of the CVEs. Seven pull requests that would have closed parts of the problem were closed without merging: four dependency updates Dependabot opened, and three from contributors, one of which carried both a Go upgrade and a CVE fix. Three of those were closed on the day v1.12.23 was released, and at that tag go.mod still named the old versions. Writing the patches elsewhere and handing them over was what finally moved them.
v1.13.0 shipped on September 14, 2026, nearly six months after the fixes were public. Operators still on v1.12 got relief first, in that line's own emergency releases.
Reporting a vulnerability
Found Something? Report It Privately
A vulnerability goes to the security address or to the repository's private advisories, never to a public issue or channel, so a fix can ship before the flaw is known. Ethereum Classic's core developers read both routes, and they are the people maintaining the client, so a report reaches someone who can cut the release that fixes the flaw. The release timeline above shows how quickly that has happened since February 2026.