Geth v1.17.8 came out on Oct. 8, 2026. The Go-Ethereum team calls it a security-focused release that "is recommended for all users". It hardens the client against several denial-of-service (DoS) attacks: some in the eth and snap peer-to-peer handlers, a crash a rogue STUN server could trigger, and two problems that only become possible after the Amsterdam fork activates. It is no longer the newest Geth, though. v1.17.9 followed on Oct. 21 and v1.17.10 on Oct. 23. Both carry the 1.17.8 fixes forward, and neither has a section labelled security. If you run a node, the version that matters today is the current release, v1.17.10.
What is new since 1.17.8
- v1.17.10, Oct. 23, 2026 (latest). This release postpones the Amsterdam fork on the Hoodi testnet, which had been set for Oct. 26, 2026, 17:42:48 UTC. Go-Ethereum says Hoodi operators running v1.17.9 must upgrade before that date. A new date will come in a future release, and other networks are unaffected. Once Amsterdam is active, snap sync also switches to the snap/2 protocol on its own. The
--snap.v2=falseand--snap.v2=trueflags override that choice. - v1.17.9, Oct. 21, 2026. This release set the Hoodi activation that 1.17.10 has now cancelled. The notes also list fixes for database corruption after a power failure (#35939, #35936), a fix for an RPC call that ran alongside block processing and could corrupt the BAL (#35905), and a fix for mempool corruption when a transaction's tip was below the base fee (#35988). They also claim interpreter opcode dispatch about 16% faster (#35638).
- Mainnet. EIP-7773, the meta-EIP that tracks the upgrade (called Glamsterdam there), has no mainnet activation date yet. On Sepolia, the upgrade was scheduled for Oct. 6, 2026. That is two days before 1.17.8 shipped, so on Sepolia the "post-Amsterdam" fixes below were due to matter before the release even arrived.
The 1.17.8 security fixes, one by one
The release notes list five security items. The table adds what the linked pull requests show, all of which were merged on Oct. 6, 2026.
| Fix | PR(s) | What the release says | What the PR shows |
|---|---|---|---|
| eth and snap packet handlers | #35862, #35883, #35859, #35857, #35904, #35856 | Improved DoS resistance in several handlers | Six separate changes. The notes do not tie these to Amsterdam |
| JUMPDEST analysis caching | #35881 | Hardened against attacks possible after Amsterdam | The author estimates that one shared cache would need roughly 900 MB after the fork, so it was split into a 64k shared buffer plus a per-transaction cache of about 48 KB at most |
| IP address predictor | #35861 | Statements now need IP verification | Only bonded (already verified) peers can now affect the node's advertised IP. Before, anyone could send pings to influence it |
| BAL accounts | #35865 | Post-Amsterdam DoS vector resolved | Caches the account code hash during BAL lookups, so it is no longer recomputed on every account read |
| STUN response | #35863 | A malicious STUN server could crash the node with an invalid response | An update of the pion/stun/v3 dependency |
BAL means block-level access lists (EIP-7928). They are a per-block record of every account and storage slot a block touches, which lets clients execute transactions in parallel. EIP-7928 is scheduled for the Glamsterdam upgrade and is in Last Call.
Which fixes depend on Amsterdam
The release summary says most of the DoS fixes concern bugs that "only become possible" after Amsterdam activates. Only some entries say so themselves. The JUMPDEST and BAL lines name the fork. The handler, IP-predictor and STUN lines do not. So a mainnet node is not shielded from all five just because mainnet has no Amsterdam date yet.
Which Geth version should your node run?
Answer two short questions about your build and network to see what the Geth releases since 1.17.8 mean for your node.
Which Geth build does your node run?
- v1.17.10 (latest, Oct. 23, 2026) → You are on the current release
- v1.17.9 (Oct. 21, 2026) → next question
- v1.17.8 (Oct. 8, 2026) → Move to the current release, v1.17.10
- Older than v1.17.8 → next question
Does this v1.17.9 node run on the Hoodi testnet?
- Yes, Hoodi → Upgrade before the old Hoodi fork time
- No, another network → Move to the current release, v1.17.10
Does this pre-1.17.8 node run on Sepolia?
- Yes, Sepolia → Your build lacks the post-Amsterdam fixes on Sepolia
- No, mainnet or another network → No Amsterdam date does not cover all five fixes
v1.17.10 carries the 1.17.8 security fixes forward and postpones Amsterdam on Hoodi. Once Amsterdam is active, snap sync moves to snap/2 by default; use the --snap.v2 flag only if you need to force one protocol.
Go-Ethereum says Hoodi operators on v1.17.9 must upgrade before Oct. 26, 2026, 17:42:48 UTC. Otherwise the node would activate a fork the rest of the network has postponed. v1.17.10 is the current release.
Your build already has the 1.17.8 security fixes. v1.17.10 keeps them and is the current release; it postpones Amsterdam on Hoodi only, and other networks are unaffected.
Amsterdam was scheduled on Sepolia for Oct. 6, 2026, and builds older than 1.17.8 lack the post-Amsterdam DoS fixes there. The current release is v1.17.10, which carries those fixes forward.
Mainnet has no Amsterdam activation date yet, but only the JUMPDEST and BAL fixes name the fork. The eth and snap handler, IP-predictor and STUN fixes do not, so an older build misses them anyway. The current release is v1.17.10.
This follows the Go-Ethereum release notes only: it cannot check your actual build or network, and it does not cover other clients, whether Amsterdam actually activated on Sepolia, or any exploitation of these bugs.
Other 1.17.8 changes worth knowing
RPC
eth_calland related operations no longer apply the transaction gas limit after Amsterdam (#35845).eth_simulateV1now reports ETH transfer logs correctly after Amsterdam (#35617), and its virtual blocks follow the Amsterdam spec (#35668).eth_createAccessListworks when the sender has no balance (#35397).eth_capabilitiesnow reports receipt availability based on the transaction hash index (#35878).- A post-Amsterdam crash in journaled live tracers is fixed (#35896).
Core, p2p and build
- The hard-coded beacon chain genesis time for the Hoodi testnet is corrected (#35876).
- blsync could stall when its server was slow or unresponsive. Fixed (#35872).
- An edge case in beacon chain head updates after an unclean shutdown is resolved (#35804).
- A correctness issue in the EIP-8070 sparse blobpool is fixed (#35860).
- The dial scheduler now handles IPv4/IPv6 changes for DNS-resolved static nodes (#35880).
- abigen now uses sequential nonces when it deploys library dependencies (#35888).
- The PPA now publishes for Ubuntu 26.04 (#35854).
What node operators can check
- Version. Compare your build with the current release (v1.17.10). Builds are available from the Geth downloads page, Docker Hub (
ethereum/client-go,stabletag), the Launchpad PPA and the Homebrew tap. - Hoodi. If you run v1.17.9 on Hoodi, Go-Ethereum says to upgrade before Oct. 26, 2026, 17:42:48 UTC, or the node would activate a fork the rest of the network has postponed.
- Sepolia. Amsterdam was scheduled there for Oct. 6, 2026. Builds older than 1.17.8 lack the post-Amsterdam DoS fixes on that network.
- Snap sync. After Amsterdam, v1.17.10 moves to snap/2 by default. Use the
--snap.v2flag only if you need to force one protocol.
Is there a CVE or advisory?
No. The 1.17.8 notes name no CVEs, and Go-Ethereum's GitHub security advisories list has no entry for these fixes. Its most recent advisories date from Feb. 17, 2026.
