CVE-2026-40583

Katalog CVE

CVSS 8.2 · High EPSS 0,57%

Kerentanan Improper Cleanup on Thrown Exception pada ultradag. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-460: Improper Cleanup on Thrown Exception
CWE-696: Incorrect Behavior Order

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp exploit · mitigasi · advisory vendor
• https://github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be patch
• https://github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511 patch