CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

• CWE-665

• https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301Issue Tracking, Mitigation, Patch, Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592Patch, Third Party Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76Third Party Advisory
• https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301Issue Tracking, Mitigation, Patch, Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592Patch, Third Party Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76Third Party Advisory

Published

Nov 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41259Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4126When receiving an OpenPGP/MIME signed email message that con…6.5
• CVE-2021-41260Galette is a membership management web application built for…8.8
• CVE-2021-41261Galette is a membership management web application built for…4.8
• CVE-2021-41262Galette is a membership management web application built for…8.8
• CVE-2021-41263rails_multisite provides multi-db support for Rails applicat…8.8
• CVE-2021-41265Flask-AppBuilder is a development framework built on top of …8.8
• CVE-2021-41266Minio console is a graphical user interface for the for MinI…9.8
• CVE-2021-41267Symfony/Http-Kernel is the HTTP kernel component for Symfony…6.5
• CVE-2021-41268Symfony/SecurityBundle is the security system for Symfony, a…8.8
• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8