CVE-2022-35936

Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.

• CWE-668

• https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203Exploit, Third Party Advisory
• https://github.com/evmos/ethermint/commit/144741832007a26dbe950512acbda4ed95b2a451Patch, Third Party Advisory
• https://github.com/evmos/ethermint/security/advisories/GHSA-f92v-grc2-w2fgThird Party Advisory
• https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203Exploit, Third Party Advisory
• https://github.com/evmos/ethermint/commit/144741832007a26dbe950512acbda4ed95b2a451Patch, Third Party Advisory
• https://github.com/evmos/ethermint/security/advisories/GHSA-f92v-grc2-w2fgThird Party Advisory

Published

Aug 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35930PolicyController is a utility used to enforce supply chain p…8.8
• CVE-2022-35931Nextcloud Password Policy is an app that enables a Nextcloud…2.7
• CVE-2022-35932Nextcloud Talk is a video and audio conferencing app for Nex…5.3
• CVE-2022-35933This package is a PrestaShop module that allows users to pos…6.1
• CVE-2022-35934TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35935TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35937TensorFlow is an open source platform for machine learning. …9.1
• CVE-2022-35938TensorFlow is an open source platform for machine learning. …9.1
• CVE-2022-35939TensorFlow is an open source platform for machine learning. …9.8
• CVE-2022-3594A vulnerability was found in Linux Kernel. It has been decla…5.3
• CVE-2022-35940TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35941TensorFlow is an open source platform for machine learning. …7.5