CVE-2021-39193

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch.

• CWE-20
• CWE-1284

• https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/465Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849aePatch, Third Party Advisory
• https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xmPatch, Third Party Advisory
• https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/465Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849aePatch, Third Party Advisory
• https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xmPatch, Third Party Advisory

Published

Sep 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39187Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2
• CVE-2021-39194kaml is an open source implementation of the YAML format wit…6.5
• CVE-2021-39195Misskey is an open source, decentralized microblogging platf…6.5
• CVE-2021-39196pcapture is an open source dumpcap web service interface . I…6.5
• CVE-2021-39197better_errors is an open source replacement for the standard…8.8
• CVE-2021-39198OroCRM is an open source Client Relationship Management (CRM…5.4
• CVE-2021-39199remark-html is an open source nodejs library which compiles …6.1