Core-Geth
An Ethereum Classic execution client and public-good Go reference client: a go-ethereum downstream released and maintained in the ethereumclassic GitHub organization, and the recommended client to run. Every v1.12 release ships known-vulnerable code, and one of those flaws was exploited against the Core-Geth v1.12 bootnodes in March 2026. The v1.12 line went 21 months without security maintenance; the v1.13 line closes every client CVE the audits found, bounds GraphQL queries, and is built with a supported Go toolchain.
Latest release
v1.13 line →Olympia release
TBD
No released client implements Olympia, which is a proposal. When Core-Geth's maintainers publish a release that does, it will be listed here; until then, run the latest release. See Olympia for node operators for what the upgrade would change for a node.
Prerequisites
- A release archive for Linux (x86_64 or ARM), macOS 12 or newer, or Windows x86_64
- A Go toolchain and a C compiler, only to build from source: Build from source in the Core-Geth documentation lists the versions
- Disk and memory for the network you sync: see Hardware requirements in the Core-Geth documentation
Run the latest release
Install and run a node
Every step from a machine with nothing installed to a node that has caught up with the network, on Linux, macOS, Windows, in a container or built from source. Downloads has every file the latest release published, with its checksum.
Move a v1.12 node to the v1.13 line
For a node on v1.12.17 or later, one step at a time on each platform, ending with deleting the v1.12 binary once the node is stable. Your chain data carries over, and the P2P node key is rotated, which is required because CVE-2026-26315 leaks bits of that key. The install steps are the wrong ones for this, because they start a node before its key changes.
A node on a release older than v1.12.17
Those releases do not schedule the Spiral upgrade, so the node has followed an obsolete chain since block 19,250,000 and cannot move in place. Remove its chain database as the documentation's Resync from scratch shows, which keeps the node's P2P node key, rename that key as the move steps do, and then install and start the v1.13 line with the install guide, which syncs the chain again.
Check what your node runs →Resync from scratch →Install Core-Geth →
A v1.12 node that cannot move yet
It can read the peer discovery lists and bootnodes the v1.13 line ships until it moves. It goes on running its v1.12 release, so this closes none of the flaws the audits found in the v1.12 line.
Verify a download
Check each file's checksum, and its build attestation, which ties the file to the release workflow that built it.
Build from source
A source build clones the main branch, where every change arrives through a pull request that needs an approving review and the project's required checks. A build of main reports v1.13.1-unstable, and like v1.13.1 it runs with MESS off by default.
Verify Installation
geth version