Denial of Service in ethereumjs-vm

HOCH 7.5CVE-2018-19183 · GHSA-2mw7-wggm-m6w3 · Published 12/11/2018 · updated 17/06/2026

Kurz gesagt

CVE-2018-19183 ist eine Schwachstelle (HOCH (CVSS 7.5)) in ethereumjs-vm (ethereumjs-vm project), ethereumjs-vm.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.1%, höher als bei 87.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
ethereumjs-vm ethereumjs-vm_project	`= 2.4.0`	No fix yet
ethereumjs-vm npm	`≤ 2.4.0`	No fix yet

Description

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute.

NVD description

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute. NOTE: the vendor disputes this because REVERT is a normal bytecode that can be triggered from high-level source code, leading to a normal programmatic execution result.

References

nvd.nist.gov/vuln/detail/CVE-2018-19183 · ADVISORY
ethereumjs/ethereumjs-vm · WEB
GitHub Advisory GHSA-2mw7-wggm-m6w3 · ADVISORY
ethereumjs/ethereumjs-vm · PACKAGE
ethereumjs/ethereumjs-monorepo
ethereumjs/ethereumjs-monorepo

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free