https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:41:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-232655 EUVD-2026-232655 https://cve.radiocsirt.org/vuln/euvd-2026-232655 https://cve.radiocsirt.org/vuln/fkie_cve-2022-35936 <p>Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract&#39;s code is recovered. The new contract deployment restores the `bytecode hash -&gt; bytecode` entry in the internal state.</p> <p>Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract&#39;s code is recovered. The new contract deployment restores the `bytecode hash -&gt; bytecode` entry in the internal state.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-35936 https://cve.radiocsirt.org/vuln/ghsa-f92v-grc2-w2fg <p><strong>Affected:</strong> Go: github.com/evmos/ethermint, Go: github.com/evmos/evmos, Go: github.com/crypto-org-chain/cronos, Go: github.com/Kava-Labs/kava</p> <p># Vulnerability Report</p> <p>## Impact</p> <p>Smart contract applications that make use of the `selfdestruct` functionality and their end-users.</p> <p>## Classification</p> <p>The vulnerability has been classified as `high` with a CVSS score of `8.2`. It has the potential to create a denial-of-service to all contracts that can invoke the [`selfdestruct`](https://ethereum.stackexchange.com/questions/315/why-are-selfdestructs-used-in-contract-programming#347) function to destroy a smart contract.</p> <p>## Users Impacted</p> <p>Due to the successfully coordinated security vulnerability disclosure, no smart contracts were impacted through the use of this vulnerability. Smart contract states and storage values are not affected by this vulnerability. User funds and balances are safe.</p> <p>## Disclosure</p> <p>In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the [`DeleteAccount`](https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203) function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE.</p> <p>### Additional Details</p> <p>The same contract bytecode can be deployed multiple times to create multiple contract instances. In the internal database, the bytecode is…</p> <p><strong>Affected:</strong> Go: github.com/evmos/ethermint, Go: github.com/evmos/evmos, Go: github.com/crypto-org-chain/cronos, Go: github.com/Kava-Labs/kava</p> <p># Vulnerability Report</p> <p>## Impact</p> <p>Smart contract applications that make use of the `selfdestruct` functionality and their end-users.</p> <p>## Classification</p> <p>The vulnerability has been classified as `high` with a CVSS score of `8.2`. It has the potential to create a denial-of-service to all contracts that can invoke the [`selfdestruct`](https://ethereum.stackexchange.com/questions/315/why-are-selfdestructs-used-in-contract-programming#347) function to destroy a smart contract.</p> <p>## Users Impacted</p> <p>Due to the successfully coordinated security vulnerability disclosure, no smart contracts were impacted through the use of this vulnerability. Smart contract states and storage values are not affected by this vulnerability. User funds and balances are safe.</p> <p>## Disclosure</p> <p>In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the [`DeleteAccount`](https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203) function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE.</p> <p>### Additional Details</p> <p>The same contract bytecode can be deployed multiple times to create multiple contract instances. In the internal database, the bytecode is…</p> https://cve.radiocsirt.org/vuln/ghsa-f92v-grc2-w2fg https://cve.radiocsirt.org/vuln/gsd-2022-35936 gsd-2022-35936 https://cve.radiocsirt.org/vuln/gsd-2022-35936