PatchTheCVEsolidity vulnerabilities and fixes
Recent CVEs affecting solidity, with upgrade or downgrade steps. 2 tracked.
solidity has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-06-23. Highest priority: CVE-2020-36402 (score 48/100).
- CVE-2022-33069 MEDIUM 5.5 DOWNGRADE Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncode
- CVE-2020-36402 HIGH 7.8 DOWNGRADE Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver
FAQ
How do I fix solidity vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is solidity being exploited right now?
None of the tracked solidity CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which solidity CVE should I patch first?
CVE-2020-36402 currently ranks highest (48/100): Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver.