CVE-2021-43839

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

• CWE-670
• CWE-670

• https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8Patch, Third Party Advisory
• https://github.com/crypto-org-chain/cronos/pull/270Patch, Third Party Advisory
• https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9rThird Party Advisory
• https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8Patch, Third Party Advisory
• https://github.com/crypto-org-chain/cronos/pull/270Patch, Third Party Advisory
• https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9rThird Party Advisory

Published

Dec 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43833eLabFTW is an electronic lab notebook manager for research t…8.8
• CVE-2021-43834eLabFTW is an electronic lab notebook manager for research t…9.8
• CVE-2021-43835Sulu is an open-source PHP content management system based o…7.2
• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5
• CVE-2021-43841XWiki is a generic wiki platform offering runtime services f…5.4
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8