Read the docs
TI-2022-16450 Aliases CVE-2022-36025GHSA-4456-w38r-m53x

Incorrect Conversion between Numeric Types in Besu Ethereum Client

Priority MEDIUM 47CWE-196Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. This issue is patched in version 22.7.1. As a workaround, reverting to version 22.1.3 or earlier will prevent incorrect execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01053 64th percentileScored 2026-11-07
Fix Fixed org.hyperledger.besu:evm (Maven): 22.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperledgerbesu> 22.1.3, < 22.7.1—No fix listedCNA
—org.hyperledger.besu:evm (Maven)22.4.0-RC1 to before 22.7.122.7.1Patch availableGHSA-4456-w38r-m53x
  • besu Vendorhyperledger Affected > 22.1.3, < 22.7.1 Fixed in — No fix listed CNA
  • org.hyperledger.besu:evm (Maven) Vendor— Affected 22.4.0-RC1 to before 22.7.1 Fixed in 22.7.1 Patch available GHSA-4456-w38r-m53x

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:besu:*:*:*:*:*:*:*:*22.4.1 to before 22.7.1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:besu:22.4.0:-:*:*:*:*:*:*22.4.0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:besu:22.4.0:rc2:*:*:*:*:*:*22.4.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:besu:*:*:*:*:*:*:*:* Versions 22.4.1 to before 22.7.1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:besu:22.4.0:-:*:*:*:*:*:* Versions 22.4.0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:besu:22.4.0:rc2:*:*:*:*:*:* Versions 22.4.0 rc2 Vulnerable ·backstage

Remediation

  • Fix · GHSA-4456-w38r-m53x org.hyperledger.besu:evm (Maven) Fixed in 22.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36025
  2. 2026-10-03 Alias added: GHSA-4456-w38r-m53x

References

Advisory 2

Other 1

  • TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
  • TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
  • TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
  • TI-2022-13065 Remote code execution in Indy's NODE_UPGRADE transaction CVSS 3.1HIGH 8.8
  • TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
  • TI-2022-13165 Improper Input Validation in fabric hyperledger CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences