solana-labs

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

solana-labs records in CISA KEV

No solana-labs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rbpf 2 records LOW Pay 1 record LOW

Records

6 records

TI-2022-07239 CVE-2022-23066 · GHSA-9qmm-4mfr-r3wj

Solana rBPF - Incorrect Calculation in sdiv instruction

MEDIUM 44

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02516 Published 2022-05-09 Fixed in 0.2.28 CWE-682

TI-2024-19999 CVE-2024-30253 · GHSA-8m45-2rjm-j347

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

MEDIUM 40

@solana/web3.js is the Solana JavaScript SDK.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2024-04-17 Fixed in 1.91.3, 1.90.2 +90 CWE-119

TI-2024-36250 CVE-2024-54134 · GHSA-jcxm-7wvp-g6p5

@solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

LOW 37

A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00543 Published 2024-12-04 Fixed in 1.95.8 CWE-200

TI-2021-21061 CVE-2021-46102 · GHSA-xwqr-xmgg-j69q

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs…

LOW 37

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01872 Published 2022-01-27 Fixed in 0.2.17 CWE-190

TI-2022-13297 CVE-2022-31264 · GHSA-ffx3-8qvm-pq3j

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program…

LOW 36

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01361 Published 2022-05-21 Fixed in 0.2.29 CWE-190

TI-2022-16344 CVE-2022-35917 · GHSA-j47c-j42c-mwqq

Weakness in Transfer Validation Logic in @solana/pay

LOW 32

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00866 Published 2022-08-01 Fixed in 0.2.1 CWE-670

Open these records in search →

Critical	1
High	4
Medium	1
Low	0
No CVSS	0