CVE Feed

    Dashboard / CVE / CVE-2022-35915

    CVE-2022-35915

    OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

    Published:Aug 1, 2022
    Last Modified:Apr 23, 2025
    EPS:Aug 1, 2022
    EPSS Score:0.004
    CVSS Score:5.3

    Affected Products

    Vendor
    Openzeppelin
    Product
    Contracts
    Vendor
    Openzeppelin
    Product
    Contracts Upgradeable
    Vendor
    Openzeppelin
    Product
    Openzeppelin-eth
    Vendor
    Openzeppelin
    Product
    Openzeppelin-solidity

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-45304 (CVSS 5.3) — Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vuln…
    CVE-2024-27094 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encode…
    CVE-2023-49798 (CVSS 5.9) — OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch…
    CVE-2023-34459 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to ver…
    CVE-2023-34234 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposa…
    CVE-2023-30541 (CVSS 5.3) — OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation co…
    CVE-2023-30542 (CVSS 6.8) — OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`…
    CVE-2023-26488 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract desi…
    CVE-2023-23940 (CVSS 6.4) — OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for Stark…
    CVE-2022-39384 (CVSS 5.6) — OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High