CVE-2021-25837

Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".

• https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107Exploit, Third Party Advisory
• https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107Exploit, Third Party Advisory

Published

Feb 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25831A file extension handling issue was found in [core] module o…9.8
• CVE-2021-25832A heap buffer overflow vulnerability inside of BMP image pro…9.8
• CVE-2021-25833A file extension handling issue was found in [server] module…9.8
• CVE-2021-25834Cosmos Network Ethermint <= v0.4.0 is affected by a transact…7.5
• CVE-2021-25835Cosmos Network Ethermint <= v0.4.0 is affected by a cross-ch…7.5
• CVE-2021-25836Cosmos Network Ethermint <= v0.4.0 is affected by cache life…7.5
• CVE-2021-25838The Import function in MintHCM RELEASE 3.0.8 allows an attac…6.1
• CVE-2021-25839A weak password requirement vulnerability exists in the Crea…9.8
• CVE-2021-25845Improper validation of the ChassisID TLV in userdisk/vport_l…7.5
• CVE-2021-25846Improper validation of the ChassisID TLV in userdisk/vport_l…7.5
• CVE-2021-25847Improper validation of the length field of LLDP-MED TLV in u…9.1
• CVE-2021-25848Improper validation of the length field of LLDP-MED TLV in u…9.1