CVE-2022-35913 json
Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin.
published 2022-09-06 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-38784
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim must try to collaborate with the attacker for a Stonewallx2 transaction. Next, the attacker broadcasts a tx, spending the inputs used in Stonewallx2 before the victim can broadcast the collaborative transaction. The attacker does not signal opt in RBF, and uses the lowest fee rate. This would result in the victim being unable to perform Stonewallx2. (Note that the attacker could use multiple paynyms.)
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
lists.linuxfoundation.org
/pipermail/bitcoin-dev/2022-June/020595.html
mailing-list, third-party-advisory
-
lists.linuxfoundation.org
/pipermail/bitcoin-dev/2022-July/020737.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2022-35913
- NVD CVE-2022-35913
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.