CVE-2022-31121highCWE-20

CVE-2022-31121: high-severity vulnerability in hyperledger fabric

Improper Input Validation in fabric hyperledger

Published · Updated

Follow this CVE+ Monitor fabric+ Monitor github.com/hyperledger/fabric

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.1%
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
hyperledger · fabric
Related CVEs — hyperledger fabric

In the same product, most dangerous first.

CVE-2022-36023HIGHRemote denial of service in Hyperledger Fabric GatewayEPSS 1.2%CVE-2026-41586CRITICALObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCEEPSS 0.5%CVE-2023-46132HIGHCrosslinking transaction attack in hyperledger/fabricEPSS 0.5%