Openzeppelin Openzeppelin-contracts vulnerabilities

• openzeppelin openzeppelin-contracts OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers CVE-2025-54070 Fix available 6.9 MediumJuly 17, 2025
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts base64 encoding may read from potentially dirty memory CVE-2024-27094 Fix available 6.5 MediumFebruary 29, 2024
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Duplicated execution of subcalls in OpenZeppelin Contracts CVE-2023-49798 Fix available 5.9 MediumDecember 8, 2023
• openzeppelin contracts, openzeppelin-contracts, contracts-upgradable +2 more OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender CVE-2023-40014 Fix available 5.3 MediumAugust 10, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees CVE-2023-34459 Fix available 5.3 MediumJune 16, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Governor proposal creation may be blocked by frontrunning in OpenZeppelin CVE-2023-34234 Fix available 5.3 MediumJune 7, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts CVE-2023-30541 Fix available 5.3 MediumApril 17, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more GovernorCompatibilityBravo may trim proposal calldata CVE-2023-30542 Fix available 6.8 MediumApril 16, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts contains Incorrect Calculation CVE-2023-26488 Fix available 6.5 MediumMarch 3, 2023
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more ECDSA signature malleability in OpenZeppelin Contracts CVE-2022-35961 Fix available 7.9 HighAugust 14, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more +4 more Unbounded gas consumption in @openzeppelin/contracts CVE-2022-35915 Fix available 5.3 MediumAugust 1, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls CVE-2022-35916 Fix available 5.3 MediumAugust 1, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVE-2022-31198 Fix available 7.5 HighAugust 1, 2022
• openzeppelin contracts, openzeppelin-contracts +1 more OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVE-2022-31170 Fix available 7.5 HighJuly 21, 2022
• openzeppelin contracts, openzeppelin-contracts +1 more OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers CVE-2022-31172 Fix available 7.5 HighJuly 21, 2022
• openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 more OpenZeppelin Contracts initializer reentrancy may lead to double initialization CVE-2022-39384 Fix available 5.6 MediumDecember 14, 2021
• openzeppelin contracts, openzeppelin-contracts +1 more UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVE-2021-41264 Fix available 9.8 CriticalSeptember 15, 2021
• openzeppelin contracts, openzeppelin-contracts +1 more TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39167 Fix available 10.0 CriticalAugust 26, 2021
• openzeppelin contracts, openzeppelin-contracts-upgradeable +1 more TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39168 Fix available 10.0 CriticalAugust 26, 2021