CVE-2023-46132

Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-362

• https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69mExploit, Mitigation, Vendor Advisory
• https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69mExploit, Mitigation, Vendor Advisory

Published

Nov 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4
• CVE-2023-46128Nautobot is a Network Automation Platform built as a web app…6.5
• CVE-2023-46129NATS.io is a high performance open source pub-sub distribute…7.5
• CVE-2023-4613This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2023-46130Discourse is an open source platform for community discussio…5.4
• CVE-2023-46131Grails is a framework used to build web applications with th…7.5
• CVE-2023-46133CryptoES is a cryptography algorithms library compatible wit…9.1
• CVE-2023-46134D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2023-46135rs-stellar-strkey is a Rust lib for encode/decode of Stellar…7.5
• CVE-2023-46136Werkzeug is a comprehensive WSGI web application library. In…7.5
• CVE-2023-46137Twisted is an event-based framework for internet application…5.3
• CVE-2023-46138JumpServer is an open source bastion host and maintenance se…5.3