CVE-2021-43839

7.5 highEPSS 1.4%

High (7.5) in crypto. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/crypto-org-chain/cronos 0.6.5.

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-670
Published: 2021-12-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

crypto:cronos
crypto:ethermint
crypto:evmos

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-f854-hpxv-cw9r	Go	github.com/crypto-org-chain/cronos	<0.6.5	0.6.5
GHSA-f854-hpxv-cw9r	Go	github.com/tharsis/ethermint	>=0.8.0 <0.10.0	0.10.0
GHSA-f854-hpxv-cw9r	Go	github.com/tharsis/evmos	<=0.4.2	no fix published
GHSA-f854-hpxv-cw9r	Go	github.com/tharsis/ethermint	<0.7.3	0.7.3

References

Check your stack JSON