CVE-2024-27094

    Dashboard / Vulnerabilities / CVE-2024-27094

    CVE-2024-27094

    Published: 29 Feb 2024Last Modified: 12 Aug 2026

    Summary: OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

    Details: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27094.json, https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967, https://nvd.nist.gov/vuln/detail/CVE-2024-27094, https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854, https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1, https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6, https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a5445b0afb8b350417b6e6ab3160554967bc151f
    Fixed -dc44c9f1a4c3b10af99492eed84f83ed244203f6

    Affected versions

    v5.0.1
    v5.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-27094 | CVE-DB