CVE-2022-35253
Hyperledger Fabric subject to Denial of Service via non-validated request
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-9w7j-q3xw-p9vh
Hyperledger Fabric subject to Denial of Service via non-validated request
A vulnerability exists in Hyperledger Fabric < 2.4 could allow an attacker to construct a non-validated request that could cause a denial of service attack. The peer gateway service tries to extract channel and chaincode information from the signed proposal, but it doesn't check the proposal fields for validity. Therefore a malformed proposal might end up crashing the peer service. This issue has been patched in 2.4.6. There are no known workarounds.
- Record
GHSA-9w7j-q3xw-p9vh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
- Record
CVE-2022-35253- Updated
- 2026-11-02
EUVDEUVD-2022-6770 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
- Record
EUVD-2022-6770- Updated
- 2026-11-03
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
- Record
CVE-2022-35253- Updated
- 2026-11-02
OSVGHSA-9w7j-q3xw-p9vh
Hyperledger Fabric subject to Denial of Service via non-validated request
A vulnerability exists in Hyperledger Fabric < 2.4 could allow an attacker to construct a non-validated request that could cause a denial of service attack. The peer gateway service tries to extract channel and chaincode information from the signed proposal, but it doesn't check the proposal fields for validity. Therefore a malformed proposal might end up crashing the peer service. This issue has been patched in 2.4.6. There are no known workarounds.
- Record
GHSA-9w7j-q3xw-p9vh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hyperledger/fabricGo |
before 2.4.6 | 2.4.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-35253 has been rejected by its source and should not be treated as a live vulnerability, published September 23, 2022. Fixed in github.com/hyperledger/fabric 2.4.6.