{"id":"CVE-2022-36023","aliases":["BIT-hyperledger-fabric-orderer-2022-36023","BIT-hyperledger-fabric-peer-2022-36023","BIT-hyperledger-fabric-tools-2022-36023","EUVD-2022-7152","GHSA-qj6r-fhrc-jj5r"],"status":"published","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01159,"percentile":0.67343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-08-18T00:00:00Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Go","package":"github.com/hyperledger/fabric","fixed_in":["2.4.6"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"hyperledger-fabric-orderer","fixed_in":["2.4.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hyperledger-fabric-peer","fixed_in":["2.4.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hyperledger-fabric-tools","fixed_in":["2.4.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hyperledger/fabric","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-orderer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-peer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-tools","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hyperledger/fabric","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}]}],"products":[{"vendor":"hyperledger","product":"fabric"}],"references":[{"url":"https://github.com/hyperledger/fabric/security/advisories/GHSA-qj6r-fhrc-jj5r","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/hyperledger/fabric/releases/tag/v2.4.6","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://github.com/hyperledger/fabric/pull/3572","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/hyperledger/fabric/pull/3576","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/hyperledger/fabric/pull/3577","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36023","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qj6r-fhrc-jj5r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36023.json","tags":["advisory"]},{"url":"https://github.com/hyperledger/fabric","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-36023","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2022-08-18T00:00:00Z","modified":"2025-04-23T17:49:14.987Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-7152","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2022-08-18T00:00:00Z","modified":"2025-04-23T17:49:14Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"ghsa":[{"id":"GHSA-qj6r-fhrc-jj5r","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"### Impact\nIf a gateway client application sends a malformed request to a gateway peer it may crash the peer node.\nThis fix checks for the malformed gateway request and returns an error to the gateway client.\n\n### Patches\nFixed in v2.4.6.\n\n### Workarounds\nNone, users must upgrade to v2.4.6.\n\n### References\nhttps://github.com/hyperledger/fabric/releases/tag/v2.4.6\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Fabric](https://github.com/hyperledger/fabric)\n\n### Credits\nThank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.\n","status":"published","published":"2022-10-13T19:12:05Z","modified":"2023-01-29T05:04:56Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:25.835323Z"}],"nvd":[{"id":"CVE-2022-36023","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2022-08-18T16:15:08.11Z","modified":"2026-06-17T04:52:45.71Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-36023","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2022-08-18T00:00:00Z","modified":"2026-10-28T02:30:50.571688278Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-qj6r-fhrc-jj5r","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"### Impact\nIf a gateway client application sends a malformed request to a gateway peer it may crash the peer node.\nThis fix checks for the malformed gateway request and returns an error to the gateway client.\n\n### Patches\nFixed in v2.4.6.\n\n### Workarounds\nNone, users must upgrade to v2.4.6.\n\n### References\nhttps://github.com/hyperledger/fabric/releases/tag/v2.4.6\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Fabric](https://github.com/hyperledger/fabric)\n\n### Credits\nThank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.\n","status":"published","published":"2022-10-13T19:12:05Z","modified":"2024-07-18T20:11:59.532781Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"BIT-hyperledger-fabric-orderer-2022-36023","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2024-07-18T19:21:59.56Z","modified":"2026-09-10T16:01:39.649440663Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hyperledger-fabric-peer-2022-36023","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2024-07-18T19:21:55.753Z","modified":"2026-09-10T16:01:39.662251194Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hyperledger-fabric-tools-2022-36023","title":"Remote denial of service in Hyperledger Fabric Gateway","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.","status":"published","published":"2024-07-18T19:21:58.651Z","modified":"2026-09-10T16:01:39.65690434Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}