CVE-2025-53359 MEDIUM

CVE-2025-53359: ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions

Vendor Rust-Ethereum
Product ethereum
Weakness CWE-754
Published July 2, 2025
Last update July 3, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability (according to EIP-2) was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559 and EIP-7702 transactions. This is a specification deviation. The signature malleability itself is not a security issue and not as high of a risk if the ethereum crate is used on a single-implementation blockchain. This issue has been patched in version v0.18.0. A workaround for this issue involves manually checking transaction malleability outside of the crate, however upgrading is recommended.

Key dates

02Disclosure timeline

July 2, 2025 CVE published
July 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-0241 Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities CVE-2020-24677 Insecure Web Service in Symphony Plus CVE-2023-28974 Junos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from subscribers the process bbe-smgd will crash CVE-2021-31364 Junos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is received CVE-2026-20719 DoS via URL Previews Rendering Malicious SVGs