CVE-2021-43839

Name: CVE-2021-43839
Creator: NVD / NIST
Published: 2021-12-21T17:15:08.413+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.31%

Last modified Jun 17, 2026

CVE-2021-43839 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. EPSS estimates a 1.31% chance of exploitation in the next 30 days.

Description

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

1.31%

67.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Crypto	Cronos	< 0.6.5
Crypto	Ethermint	< 0.7.3
Crypto	Ethermint	>= 0.8.0, <= 0.9.0
Crypto	Evmos	<= 0.4.2

References

https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8Patch, Third Party Advisory
https://github.com/crypto-org-chain/cronos/pull/270Patch, Third Party Advisory
https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9rThird Party Advisory
https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8Patch, Third Party Advisory
https://github.com/crypto-org-chain/cronos/pull/270Patch, Third Party Advisory
https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9rThird Party Advisory

Timeline

Published: Dec 21, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-43839?

How severe is CVE-2021-43839?

CVE-2021-43839 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.31% probability of exploitation in the next 30 days.

How do I fix CVE-2021-43839?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-43839?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST