id: GO-2021-0105
modules:
    - module: github.com/ethereum/go-ethereum
      versions:
        - introduced: 1.9.4
          fixed: 1.9.20
      vulnerable_at: 1.9.20-0.20200821114314-b68929caee77
      packages:
        - package: github.com/ethereum/go-ethereum/core/state
          symbols:
            - StateDB.createObject
          derived_symbols:
            - StateDB.AddBalance
            - StateDB.CreateAccount
            - StateDB.GetOrNewStateObject
            - StateDB.SetBalance
            - StateDB.SetCode
            - StateDB.SetNonce
            - StateDB.SetState
            - StateDB.SetStorage
            - StateDB.SubBalance
summary: Consensus flaw in github.com/ethereum/go-ethereum
description: |-
    Due to an incorrect state calculation, a specific set of transactions could
    cause a consensus disagreement, causing users of this package to reject a
    canonical chain.
published: 2021-07-28T18:08:05Z
cves:
    - CVE-2020-26265
ghsas:
    - GHSA-xw37-57qp-9mm4
credits:
    - John Youngseok Yang (Software Platform Lab)
references:
    - fix: https://github.com/ethereum/go-ethereum/pull/21080
    - fix: https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a