{"cve":"CVE-2021-43839","nvd":{"published":"2021-12-21T17:15:08.413","modified":"2026-06-17T04:11:32.783","status":"Modified","description":"Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-670"],"references":["https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8","https://github.com/crypto-org-chain/cronos/pull/270","https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9r","https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8","https://github.com/crypto-org-chain/cronos/pull/270"],"products":["crypto:cronos","crypto:ethermint","crypto:evmos"],"source":"nvd","synced_at":"2026-10-19T21:26:33.761856376+00:00"},"epss":{"cve":"CVE-2021-43839","score":0.01356,"percentile":0.71649,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-f854-hpxv-cw9r","url":"https://osv.dev/vulnerability/GHSA-f854-hpxv-cw9r","summary":"Drainage of FeeCollector's Block Transaction Fees in cronos","modified":"2026-07-08T06:29:14.059124576Z","packages":[{"ecosystem":"Go","name":"github.com/crypto-org-chain/cronos","purl":"pkg:golang/github.com/crypto-org-chain/cronos","ranges":["<0.6.5"],"fixed":["0.6.5"]},{"ecosystem":"Go","name":"github.com/tharsis/ethermint","purl":"pkg:golang/github.com/tharsis/ethermint","ranges":[">=0.8.0 <0.10.0"],"fixed":["0.10.0"]},{"ecosystem":"Go","name":"github.com/tharsis/evmos","purl":"pkg:golang/github.com/tharsis/evmos","ranges":["<=0.4.2"],"fixed":[]},{"ecosystem":"Go","name":"github.com/tharsis/ethermint","purl":"pkg:golang/github.com/tharsis/ethermint","ranges":["<0.7.3"],"fixed":["0.7.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}