Openzeppelin vulnerabilities

Products

• Contracts 20
• Openzeppelin-contracts 18
• Contracts Upgradeable 12
• Cairo-contracts 3
• Contracts-wizard 2

Newest

• @openzeppelin wizard, wizard-cairo, wizard-stellar +2 more +4 more OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source CVE-2026-57583 Fix available 3.3 LowJune 19, 2026
• openzeppelin contracts-wizard OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri CVE-2026-48054 Fix available 8.8 HighJune 11, 2026
• openzeppelin openzeppelin-confidential-contracts OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. CVE-2026-73645 Fix available 6.6 MediumJanuary 5, 2026
• openzeppelin openzeppelin-contracts OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers CVE-2025-54070 Fix available 6.9 MediumJuly 17, 2025
• openzeppelin cairo-contracts, contracts +1 more OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts CVE-2024-45304 5.3 MediumAugust 30, 2024
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts base64 encoding may read from potentially dirty memory CVE-2024-27094 Fix available 6.5 MediumFebruary 29, 2024
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Duplicated execution of subcalls in OpenZeppelin Contracts CVE-2023-49798 Fix available 5.9 MediumDecember 8, 2023
• openzeppelin contracts, openzeppelin-contracts, contracts-upgradable +2 more OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender CVE-2023-40014 Fix available 5.3 MediumAugust 10, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees CVE-2023-34459 Fix available 5.3 MediumJune 16, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Governor proposal creation may be blocked by frontrunning in OpenZeppelin CVE-2023-34234 Fix available 5.3 MediumJune 7, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts CVE-2023-30541 Fix available 5.3 MediumApril 17, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more GovernorCompatibilityBravo may trim proposal calldata CVE-2023-30542 Fix available 6.8 MediumApril 16, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts contains Incorrect Calculation CVE-2023-26488 Fix available 6.5 MediumMarch 3, 2023
• openzeppelin contracts, cairo-contracts +1 more OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass CVE-2023-23940 Fix available 6.4 MediumFebruary 2, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more ECDSA signature malleability in OpenZeppelin Contracts CVE-2022-35961 Fix available 7.9 HighAugust 14, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more +4 more Unbounded gas consumption in @openzeppelin/contracts CVE-2022-35915 Fix available 5.3 MediumAugust 1, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls CVE-2022-35916 Fix available 5.3 MediumAugust 1, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVE-2022-31198 Fix available 7.5 HighAugust 1, 2022
• openzeppelin contracts, openzeppelin-contracts +1 more OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVE-2022-31170 Fix available 7.5 HighJuly 21, 2022
• openzeppelin contracts, openzeppelin-contracts +1 more OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers CVE-2022-31172 Fix available 7.5 HighJuly 21, 2022
• openzeppelin contracts, cairo-contracts +1 more OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVE-2022-31153 Fix available 6.5 MediumJuly 15, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts initializer reentrancy may lead to double initialization CVE-2022-39384 Fix available 5.6 MediumDecember 14, 2021
• openzeppelin Improper Initialization in OpenZeppelin CVE-2021-46320 Fix available 7.5 HighDecember 14, 2021
• openzeppelin contracts, openzeppelin-contracts +1 more UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVE-2021-41264 Fix available 9.8 CriticalSeptember 15, 2021
• openzeppelin contracts, openzeppelin-contracts +1 more TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39167 Fix available 10.0 CriticalAugust 26, 2021
• openzeppelin contracts, openzeppelin-contracts-upgradeable +1 more TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39168 Fix available 10.0 CriticalAugust 26, 2021