Homepage
About Snyk

@openzeppelin/contracts-upgradeable@5.0.0-rc.1 vulnerabilities

Secure Smart Contract library for Solidity

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @openzeppelin/contracts-upgradeable package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Out-of-bounds Read

@openzeppelin/contracts-upgradeable is a Secure Smart Contract library for Solidity.

Affected versions of this package are vulnerable to Out-of-bounds Read due to the Base64.encode function. An attacker can corrupt the output by manipulating the extra bits that are kept between the encoding and padding when the input is not a multiple of 3, leading to parts of the memory beyond the input buffer being read.

Note: These conditions are more frequent in the following scenarios:

  1. A bytes memory struct is allocated just after the input and the first bytes of it are non-zero.

  2. The memory pointer is set to a non-empty memory location before allocating the input.

How to fix Out-of-bounds Read?

Upgrade @openzeppelin/contracts-upgradeable to version 4.9.6, 5.0.2 or higher.

>=4.5.0 <4.9.6 >=5.0.0-rc.0 <5.0.2
Go back to all versions of this package