OpenZeppelin openzeppelin-contracts
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-54070 | >= 5.2.0, < 5.4.0 | OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers | MEDIUM 6.9 | 0.4 % | ||
| CVE-2024-27094 | >= 4.5.0, < 4.9.6 ; >= 5.0.0-rc.0, < 5.0.2 | OpenZeppelin Contracts base64 encoding may read from potentially dirty memory | HIGH 7.4 | 0.8 % | ||
| CVE-2023-49798 | = 4.9.4 | Duplicated execution of subcalls in OpenZeppelin Contracts | HIGH 7.5 | 0.5 % | ||
| CVE-2023-40014 | >= 4.0.0, < 4.9.3 | OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-34459 | >= 4.7.0, < 4.9.2 | OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees | MEDIUM 5.9 | 0.4 % | ||
| CVE-2023-34234 | >=4.3.0, < 4.9.1 | Governor proposal creation may be blocked by frontrunning in OpenZeppelin | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-30541 | @openzeppelin/contracts: >= 3.2.0, < 4.8.3 ; @openzeppelin/contracts-upgradeable: >=3.2.0, <4.8.3 | TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts | MEDIUM 5.3 | 0.8 % | ||
| CVE-2023-30542 | >= 4.3.0, < 4.8.3 | GovernorCompatibilityBravo may trim proposal calldata | HIGH 8.8 | 0.6 % | ||
| CVE-2023-26488 | >= 4.8.0, < 4.8.2 | OpenZeppelin Contracts contains Incorrect Calculation | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-39384 | >= 3.2.0, < 4.4.1 | OpenZeppelin Contracts initializer reentrancy may lead to double initialization | MEDIUM 5.6 | 0.6 % | ||
| CVE-2022-35961 | >= 4.1.0, < 4.7.3 | ECDSA signature malleability in OpenZeppelin Contracts | HIGH 7.9 | 0.5 % | ||
| CVE-2022-35915 | >=2.0.0 < 4.7.2 | Unbounded gas consumption in @openzeppelin/contracts | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-35916 | >= 4.6.0, < 4.7.2 | Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-31198 | >= 4.3.0, < 4.7.2 | GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts | HIGH 7.5 | 0.8 % | ||
| CVE-2022-31170 | >= 4.0.0, < 4.7.1 | OpenZeppelin Contracts's ERC165Checker may revert instead of returning false | HIGH 7.5 | 0.8 % | ||
| CVE-2022-31172 | >= 4.1.0, < 4.7.1 | OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers | HIGH 7.5 | 0.5 % | ||
| CVE-2021-41264 | >= 4.1.0 < 4.3.2 | UUPSUpgradeable vulnerability in OpenZeppelin Contracts | CRITICAL 9.8 | 1.5 % | ||
| CVE-2021-39167 | >=4.0.0, < 4.3.1 ; >=3.3.0, < 3.4.2 ; >= 3.3.0-solc-0.7, < 3.4.2-solc-0.7 | TimelockController vulnerability in OpenZeppelin Contracts | CRITICAL 10.0 | 1.6 % |