The v1.12 line went 21 months without security maintenance, and in March 2026 one of the flaws that gap left open was used to crash Core-Geth v1.12 bootnodes. The v1.13 line closes all six client CVEs the audits found, that one among them. Every finding on this page is measured, dated and linked to the audit that records it, so nothing here has to be taken on trust.
The last stable release from etclabscore/core-geth was v1.12.20, before 21 months of dormancy, through which contributors' issues and pull requests went unmerged. The emergency releases that eventually followed were still built on Go versions no longer supported. Go is compiled into the binary rather than loaded when it runs, so each of those releases carries 75 known Go security flaws for as long as the node is up, and nothing short of a new build removes them.
One of the flaws left unpatched through the gap was used against Core-Geth v1.12 bootnodes in March 2026, in an attack on that line. Ethereum Classic core developers had resumed maintenance in ethereumclassic/core-geth the month before and had disclosed the fixes privately to the etclabscore/core-geth maintainers, who copied them into emergency v1.12 releases while the v1.13 line was built and tested in ethereumclassic/core-geth for the network to move to.
v1.13.0, published from ethereumclassic/core-geth, fixes all six client CVEs the audits found in the v1.12 client code and returns the dependencies and the Go toolchain to supported versions. Every node still on a v1.12 release should move to the v1.13 line.
The 21 months between June 2024 and February 2026 are the gap. This runs from the last release before it to the one that closed it, and each release names the repository that published it: what etclabscore/core-geth cut as an emergency patch, and what was built, tested and released in ethereumclassic/core-geth. Every release in this timeline but the last is still exposed, and each entry says what it left open.
v1.12.20 from etclabscore/core-geth
The last stable release from etclabscore/core-geth before a 21-month gap in security maintenance, from June 2024 to February 2026. All six client CVEs are unpatched in it, including the one later used against the bootnodes. The last commit of any kind in that repository was a dependency bump in January 2025, and the private security disclosures sent to it through 2025 got no response.
Maintenance moves to ethereumclassic/core-geth
The ETC Cooperative entered maintenance mode at the end of 2024, stopped developing Core-Geth in 2025 and wound down its team. ethereumclassic/core-geth was created on December 21, 2024 from the previous repository's commit of December 16, 2024, the move the Cooperative's own roadmap of July 2024 had proposed, and the history up to that commit is preserved in this repository on a tagged branch. It is the same client in the Ethereum Classic community's own organization, and no stakeholder took the maintenance up until February 2026, which is why the gap runs as long as it does.
ROADMAP: “Move Core Geth to the Ethereum Classic community GitHub repository: This would restore sovereignty of the community on the node client software.” - ETC Cooperative, 2024
A Wyoming DAO LLC, and the legal counterpart Ethereum Classic's public goods have when one is required: funding has to be received and reported in a tax jurisdiction, and an organization sponsoring the work has to contract with someone. It took up Core-Geth's maintenance in February 2026 as the funder of last resort, with Ethereum Classic's core developers and open community contributions doing the day-to-day work. It does not control or lead Ethereum Classic, and it is not the only organization that can fund this work.
Ethereum Classic core developers began work on the next release line in ethereumclassic/core-geth: the outstanding CVEs patched, a supported Go toolchain, the release pipeline rebuilt. The first patch was authored on February 26, and the line was tested on Ethereum Classic mainnet and Mordor from then until release. They are the stakeholders the Cooperative's retrospective had left it to.
RETROSPECTIVE: “it will be up to other stakeholders to take on any required maintenance of the ETC client” - ETC Cooperative, 2024
Private disclosure to the etclabscore/core-geth maintainers
Ethereum Classic core developers reported the security work privately to the etclabscore/core-geth maintainers before publishing any of it. Nothing went public in ethereumclassic/core-geth until after the first emergency release was cut in etclabscore/core-geth.
The bootnode attack on the Core-Geth v1.12 line
A flaw left open through the gap was used against Core-Geth v1.12 bootnodes in production in March 2026: a handshake crash loop that panics the node on a malformed message. A second flaw patched in the same emergency release, an oracle that leaks bits of a node's P2P key across repeated handshakes, was not part of the attack but is the reason a node that ran the v1.12 line must rotate its P2P key. Every release published before March 18, 2026 carries both flaws.
v1.12.21 from etclabscore/core-geth
etclabscore/core-geth cut this release about five hours after the attack was reported, from the patches Ethereum Classic core developers had disclosed privately to the etclabscore/core-geth maintainers in February and March 2026. It closed the exploited crash and the key oracle alongside it and capped the size of a handshake message, and left four known CVEs open. Its Go toolchains were unchanged and GraphQL queries still unbounded, and its notes did not tell operators to rotate the node key the oracle had exposed. Its release pull request was opened and merged by a single account in about 70 minutes, with no reviewer recorded.
The fixes are published in ethereumclassic/core-geth
27 pull requests, #10 to #36, each scoped to a single change: a fix for each of the six CVEs, with a test and a linked advisory, plus the Go toolchain upgrade and the rebuilt release pipeline. Everything the rest of this page measures has been public since March 2026.
v1.12.22 from etclabscore/core-geth
etclabscore/core-geth cut this release 95 seconds after its pull request opened, again with no reviewer recorded. It backported two more CVE fixes and left two of the six client CVEs open: one mitigated rather than fixed, so a peer can still exhaust a node's CPU on a message that node will reject, and one never addressed at all, having been declared not applicable to Ethereum Classic. The Go toolchains were unchanged and GraphQL queries still unbounded. It also introduced a regression in eth_syncing: a node reports the wrong network head, which misleads the exchanges, explorers and monitoring that read it to decide whether that node has finished syncing.
v1.12.23 from etclabscore/core-geth
The last release from etclabscore/core-geth, and still not one to run today. It hardened how peer messages are decoded and left everything else open: one client CVE unpatched and another only mitigated, the eth_syncing regression untouched, GraphQL queries unbounded, the Go toolchains out of support, and a response cap added in that release which can disconnect peers that are answering correctly.
Bootnodes and peer discovery move to this organization
A node finds its first peers through bootnodes and the peer discovery lists. ethereumclassic/discv4-dns-lists was created on August 28, 2026 to publish those lists from the ethereumclassic organization, the first crawl of the network followed on September 10, and v1.13.0 ships with three Ethereum Classic and two Mordor bootnodes run by the Core-Geth maintainers and reads the new lists by default.
Seven months of work, tested on Ethereum Classic mainnet and Mordor throughout: all six client CVEs the audits found in the v1.12 client code closed, GraphQL queries bounded, the eth_syncing regression fixed, and a supported Go toolchain. The release pipeline was rebuilt in ethereumclassic/core-geth too, so each archive names the machine it runs on and carries a checksum and a build attestation binding it to the workflow run that produced it. This repository has several maintainers with admin access and takes pull requests from anyone, which is what the previous repository's single-author emergency releases did not have.
Most Ethereum Classic nodes are running an exposed release
The v1.13 line patches all six client CVEs the audits found in the v1.12 client code, bounds GraphQL queries and is built with a supported Go version, so none of the 75 Go flaws the v1.12 builds carry is in it. Run a v1.13 node beside your current ones without sending it traffic, and when you are comfortable, move your whole fleet to it.
Core-Geth nodes seen on September 17, 2026, counted by etcnodes.org.
On an exposed release
97.5%
511 nodes running a release with a client CVE still open.
On the v1.13 line
1.7%
9 nodes running the line with every client CVE patched.
Audits and reports
7
Five audits covering the v1.12 line and the work that replaced it, and two v1.13 release reports. Every finding on this page is measured, dated and linked to one of them.
Core-Geth nodes by release on , 524 in all. Source: etcnodes.org. The 4 nodes not listed above ran a development build of the previous repository's master, which is not a release.
6 client CVEs open, 75 known Go flaws with 59 in the binary, GraphQL queries unbounded
What v1.12.20 and older carries
Every one of the six client CVEs is unpatched here, and one of them was used against Core-Geth v1.12 bootnodes in March 2026. It was also built with Go 1.21, a version the Go project has since published 75 security fixes for: in 59 of them the flawed code is compiled into the binary you would be running. Whether a node can be made to reach that code was not tested, so treat it as exposure to rule out rather than proven.
v1.12.21, exposed
50
9.5%
4 client CVEs open, 75 known Go flaws with 59 in the binary, GraphQL queries unbounded
What v1.12.21 carries
Closes the two handshake encryption flaws, CVE-2026-22862 and CVE-2026-26315, and caps the size of a handshake message. Four flaws stay open: CVE-2025-24883, CVE-2026-26314, CVE-2026-26313 and CVE-2026-22868. A GraphQL query can still nest without limit, which can exhaust a node that serves it, and the Go build is the same as above.
v1.12.22, exposed
165
31.5%
1 client CVE open and 1 only mitigated, 75 known Go flaws with 59 in the binary, GraphQL queries unbounded, eth_syncing regression
What v1.12.22 carries
Adds the key checks for CVE-2025-24883 and CVE-2026-26314. For CVE-2026-26313 its own commit says mitigation rather than fix: the node stops a peer exhausting its memory, but still reads the whole message, so the attack still costs it work. CVE-2026-22868 was called not applicable to Ethereum Classic and left unpatched, though the same binary also serves Ethereum, Sepolia and Holesky, where the affected feature is switched on. This release is also where eth_syncing starts reporting the wrong sync height, reported in etclabscore/core-geth as issue #697 and still open. Same Go build as above.
v1.12.23, exposed
138
26.3%
1 client CVE open and 1 only mitigated, 75 known Go flaws with 59 in the binary, GraphQL queries unbounded, eth_syncing regression
What v1.12.23 carries
Hardens how peer messages are decoded, and adds a cap on snap sync responses that can disconnect peers which are answering correctly. What stays open: CVE-2026-26313 is still only mitigated, CVE-2026-22868 still unpatched, GraphQL queries still unbounded, and eth_syncing still wrong, its report still open. Its archives were built with Go 1.21.13 or Go 1.22.1, versions the Go project had already stopped supporting when this shipped, and 62 of the 75 Go fixes above had been published before the release date.
v1.13.0, recommended
9
1.7%
every client CVE patched, a supported Go build, GraphQL queries bounded
What v1.13.0 carries
All six client CVEs the audits found in the v1.12 client code are closed here, CVE-2026-22868 among them, GraphQL queries are bounded and the eth_syncing regression is fixed. Built with Go 1.26.8, a supported version, so none of the 75 Go flaws above is in the binary. Seven months of work cleared the debt behind them: the dependency tree modernized, and the release pipeline rebuilt so each archive carries a checksum and a build attestation. Released September 14, 2026, and the release report lists what is known to be imperfect in it.
Everything the 2026 Core-Geth v1.12 audits found, published in full
These five examine the v1.12 line and the work that replaced it: that line's client code, the Go toolchain its binaries inherit, its dependency tree, and the archives it published. Every figure on this page comes from one of them or from the v1.13 release reports under them. If you run a node, migrate to the v1.13 line and read these reports with your security engineers: each one carries its method and its raw measurements, so you can verify every claim and judge what running v1.12 exposed you to.
What 21 months without security maintenance in etclabscore/core-geth left open in the v1.12 client code, and the March 2026 attack that used two of those flaws against Core-Geth v1.12 bootnodes. It names which releases carry each flaw.
v1.12.23 Argos is real security work and an improvement on the rest of the v1.12 line, and still not safe to run: one client CVE unpatched, another only mitigated, the Go toolchains out of support. Only v1.13 clears those, and a node that ran v1.12 needs a new P2P key.
What the maintenance gap left behind in the v1.12 line: a module graph that had not moved since December 2024, and Go toolchains already out of support. v1.13 moved it onto a supported Go with 83 module changes behind it, and records why each version was chosen.
Nobody was checking what those releases contained until the v1.13 work opened them. The Linux glibc floor rose across three v1.12 releases unobserved, the macOS archive ships a binary most of its downloaders cannot run, and no archive is signed or attested.
Every v1.12 binary carries the security flaws of the Go version it was built with, and those toolchains left support in 2024 and 2025. Only a rebuild removes them, and no v1.12 release is one, so the v1.13.0 binaries are the only clean ones to run from here on.
The Core-Geth v1.13 release
What the Core-Geth v1.13 fixes, and how to check it
The v1.13 line closes all six client CVEs the audits found in the v1.12 client code, including the one used against Core-Geth v1.12 bootnodes in March 2026 and the one etclabscore/core-geth declared not applicable to Ethereum Classic, and it bounds the GraphQL query nesting that line left unlimited. It fixes the eth_syncing regression etclabscore/core-geth introduced, which made a node report the wrong network head to the exchanges, explorers and monitoring that read it. It is built with a supported Go toolchain, so none of the Go standard library flaws the older archives carry is in the binary, and the dependency tree behind it was modernized in the same work. It reads peer discovery lists published from the ethereumclassic organization, ships bootnodes run by the Core-Geth maintainers, and is cut by a rebuilt release pipeline that gives each archive a checksum and a build attestation binding it to the workflow run that produced it. Every node still on a v1.12 release should move to the v1.13 line.
Both reports below cover v1.13.0 itself rather than the line it replaced. One reports the release, down to what is known to be imperfect in it; the other answers every claim this site makes about it from the public record.
Every claim made about v1.13.0 answered from the public record: commit metadata, pull requests, release files and advisory databases.
How disclosure was handled
The fixes were disclosed before they were published
Ethereum Classic core developers wrote the patches, reported them privately to the etclabscore/core-geth maintainers in February and March 2026, and published them in ethereumclassic/core-geth as 27 individually scoped pull requests on March 20 and 21, 2026. etclabscore/core-geth cut its emergency releases on March 18 and 28, 2026 by copying those patches into the v1.12 line.
Others had tried to get the same problems fixed there first, and the record of those attempts is public. Private security disclosures sent to etclabscore/core-geth through 2025 got no response, and so did a public issue a security researcher at Ledger opened in February 2026 naming three of the CVEs. Seven pull requests that would have closed parts of the problem were closed without merging: four dependency updates Dependabot opened, and three from contributors, one of which carried both a Go upgrade and a CVE fix. Three of those were closed on the day v1.12.23 was released, and at that tag go.mod still named the old versions. Writing the patches elsewhere and handing them over was what finally moved them.
v1.13.0 shipped on September 14, 2026, nearly six months after the fixes were public, and was tested on Ethereum Classic mainnet and Mordor throughout. Operators still on v1.12 got relief first, in that line's own emergency releases, and were advised to move to the v1.13 line once it shipped in September 2026.
A vulnerability goes to the security address or to the repository's private advisories, never to a public issue or channel, so a fix can ship before the flaw is known. Ethereum Classic's core developers read both routes, and they are the people maintaining the client, so a report reaches someone who can cut the release that closes it. The release timeline above shows how quickly that has happened since February 2026.
