CVE-2024-27094 json
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
published 2024-02-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0602 , GHSA-9vx6-7xxf-x967
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Patch / fix
- npm @openzeppelin/contracts 4.9.6, 5.0.2
- npm @openzeppelin/contracts-upgradeable 4.9.6, 5.0.2
- openzeppelin contracts 4.9.6, 5.0.2
- openzeppelin openzeppelin_contracts 4.9.6, 5.0.2
- openzeppelin contracts_upgradeable 4.9.6, 5.0.2
- openzeppelin openzeppelin_contracts-upgradable 4.9.6, 5.0.2
- openzeppelin openzeppelin_contracts-upgradeable 4.9.6, 5.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @openzeppelin/contracts | >=4.5.0, <4.9.6 >=5.0.0-rc.0, <5.0.2 |
4.9.6 5.0.2 |
| npm | @openzeppelin/contracts-upgradeable | >=5.0.0-rc.0, <5.0.2 >=4.5.0, <4.9.6 |
5.0.2 4.9.6 |
Affected products
- OpenZeppelin openzeppelin-contracts
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
github.com
/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854
web, patch
-
github.com
/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1
web, patch
-
github.com
/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6
web, patch
-
github.com
/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c
web, patch
-
github.com
/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27094
advisory
-
github.com
/OpenZeppelin/openzeppelin-contracts
package
Sources
- CVE List CVE-2024-27094
- GitHub Advisory GHSA-9vx6-7xxf-x967
- NVD CVE-2024-27094
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.