Approved changes feed: RSS · Atom

cpe:2.3:a:elrond:elrond_go:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorElrond (fbba65e8-1009-579a-84e7-64723aafba24)
ProductElrond Go (bc0ee792-7e2c-5e62-8560-8264ef766d58)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/elrondnetwork/elrond-go purl2cpe 2026-06-01 10:12:59.210121

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-46173 vulnerable 2026-06-08 05:50:38.305359 Elrond go Processing: fallback search of SCRs when not found in the main cache
HIGH (7.2)
Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.
Published: 2022-12-28T06:27:55.036Z
Updated: 2025-04-11T15:46:02.255Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-36061 vulnerable 2026-06-08 05:46:06.237868 Elrond go can execute on same context checks in VM
MEDIUM (6.5)
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.35, read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract's B state, the state will be altered for contract B as if the call was not made in the read-only mode. This can lead to some effects not designed by the original smart contracts programmers. This issue was patched in version 1.3.35. There are no known workarounds.
Published: 2022-09-06T20:35:10.000Z
Updated: 2025-04-22T17:24:16.700Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-36058 vulnerable 2026-06-08 05:46:06.233913 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
HIGH (7.5)
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds.
Published: 2022-09-06T20:10:09.000Z
Updated: 2025-04-22T17:24:22.746Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.