contracts upgradeable vulnerabilities and fixes

Recent CVEs affecting contracts upgradeable, with upgrade or downgrade steps. 4 tracked.

Also searched as: contractsupgradeable.

contracts upgradeable has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2024-03-21. Highest priority: CVE-2024-27094 (score 42/100).

• CVE-2024-27094 MEDIUM 6.5 UPGRADE UPGRADE OpenZeppelin Contracts is a library for secure smart contract development
• CVE-2023-49798 MEDIUM 5.9 DOWNGRADE DOWNGRADE OpenZeppelin Contracts is a library for smart contract development
• CVE-2023-34459 MEDIUM 5.3 UPGRADE UPGRADE OpenZeppelin Contracts is a library for smart contract development
• CVE-2023-34234 MEDIUM 5.3 UPGRADE UPGRADE OpenZeppelin Contracts is a library for smart contract development

FAQ

How do I fix contracts upgradeable vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is contracts upgradeable being exploited right now?

None of the tracked contracts upgradeable CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which contracts upgradeable CVE should I patch first?

CVE-2024-27094 currently ranks highest (42/100): OpenZeppelin Contracts is a library for secure smart contract development.

RSS feed for contracts upgradeable · ← Back to latest CVEs