CVE-2021-43839

mediumpriority · track · 20EPSS 0.014 · 71 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.36% (71st) EPSS

CVSS 5 · medium

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-670USprimaryCWE-670US

affected products (9)

Products and version ranges known to be affected.

crypto-org-chain cronos≤ < 0.6.5enisa_euvdEU
crypto cronos< 0.6.5nvdUScpe:2.3:a:crypto:cronos:*:*:*:*:*:*:*:*
crypto ethermint< 0.7.3nvdUScpe:2.3:a:crypto:ethermint:*:*:*:*:*:*:*:*
crypto ethermint0.8.0 → 0.9.0nvdUScpe:2.3:a:crypto:ethermint:*:*:*:*:*:*:*:*
crypto evmos≤ 0.4.2nvdUScpe:2.3:a:crypto:evmos:*:*:*:*:*:*:*:*
Go github.com/crypto-org-chain/cronos< 0.6.5osvUSpkg:golang/github.com/crypto-org-chain/cronos
Go github.com/tharsis/ethermint< 0.7.3osvUSpkg:golang/github.com/tharsis/ethermint
Go github.com/tharsis/ethermint0.8.0 → 0.10.0osvUSpkg:golang/github.com/tharsis/ethermint
Go github.com/tharsis/evmos≤ 0.4.2osvUSpkg:golang/github.com/tharsis/evmos

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-f854-hpxv-cw9rDrainage of FeeCollector's Block Transaction Fees in cronos2022-01-06ghsa · osvUS
### Impact In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. User funds and balances are safe. ### Patches This problem has been patched in Cronos v0.6.5 on the mempool level. The next network upgrade with consensus-breaking changes will patch it on the consensus level. ### Workarounds There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience. ### Credits Thank you to @zb3 for reporting this issue on [Cronos Immunefi Bug Bounty Program](https://immunefi.com/bounty/cronos/), to @cyril-crypto for reproducing the issue and to @yihuang and @thomas-nguy for patching the issue on the CheckTx (mempool) and the DeliverTx (consensus) levels. ### For more information If you have any questions or comments about this advisory: * Open a discussion in [crypto-org-chain/cronos](https://github.com/crypto-org-chain/cronos/discussions/new) * Email us at [chain@crypto.org](mailto:chain@crypto.org)

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2021-12-21modified 2026-06-17

related (562)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-32896US	high7.8OT critical	2.99% (87th)	KEV	2024-06-13
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2020-28052US	high8.1	7.22% (94th)	Exploit	2020-12-18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, all…
CVE-2023-0400US	high8.2	0.42% (36th)	Exploit	2023-02-02
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from…
CVE-2026-35414US	high8.1	0.21% (12th)	Exploit	2026-04-02
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certai…
CVE-2026-38361US	high7.5	2.64% (86th)	Exploit	2026-05-08
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_upl…

+557 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan