CVE-2022-35915 MEDIUM

CVE-2022-35915: Unbounded gas consumption in @openzeppelin/contracts

Vendor Openzeppelin
Product openzeppelin-contracts
Weakness CWE-400
Published August 1, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

August 1, 2022 CVE published
April 23, 2025 Record updated