https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:23:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-214036 EUVD-2026-214036 https://cve.radiocsirt.org/vuln/euvd-2026-214036 https://cve.radiocsirt.org/vuln/fkie_cve-2023-34234 <p>OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.</p> <p>OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-34234 https://cve.radiocsirt.org/vuln/ghsa-5h3x-9wvq-w4m2 <p><strong>Affected:</strong> npm: @openzeppelin/contracts, npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.</p> <p>This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0.</p> <p>### Patches</p> <p>The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.</p> <p>### Workarounds</p> <p>Submit the proposal creation transaction to an endpoint with frontrunning protection.</p> <p>### Credit</p> <p>Reported by Lior Abadi and Joaquin Pereyra from Coinspect.</p> <p>### References</p> <p>https://www.coinspect.com/openzeppelin-governor-dos/</p> <p><strong>Affected:</strong> npm: @openzeppelin/contracts, npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.</p> <p>This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0.</p> <p>### Patches</p> <p>The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.</p> <p>### Workarounds</p> <p>Submit the proposal creation transaction to an endpoint with frontrunning protection.</p> <p>### Credit</p> <p>Reported by Lior Abadi and Joaquin Pereyra from Coinspect.</p> <p>### References</p> <p>https://www.coinspect.com/openzeppelin-governor-dos/</p> https://cve.radiocsirt.org/vuln/ghsa-5h3x-9wvq-w4m2 https://cve.radiocsirt.org/vuln/gsd-2023-34234 gsd-2023-34234 https://cve.radiocsirt.org/vuln/gsd-2023-34234