CVE-2022-36008 json
Message length overflow in frontier
published 2022-08-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-mjvm-mhgc-q4gp , EUVD-2022-6586
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic. No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this. There are currently no known workarounds.
Patch / fix
- github.com/paritytech/frontier@fff8cc4 commit
- github.com/paritytech/frontier#820 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | fc-rpc | <=1.0.0 |
no fix listed |
Affected products
- paritytech frontier
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
github.com
/paritytech/frontier/pull/820
web, issue-tracking, patch, third-party-advisory
-
github.com
/paritytech/frontier/commit/fff8cc43b7756ce3979a38fc473f38e6e24ac451
web, patch, third-party-advisory
-
github.com
/paritytech/frontier/security/advisories/GHSA-mjvm-mhgc-q4gp
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36008
advisory
-
github.com
/paritytech/frontier
package
Sources
- CVE List CVE-2022-36008
- GitHub Advisory GHSA-mjvm-mhgc-q4gp
- NVD CVE-2022-36008
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.