CVE-2024-41945

fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.

• CWE-20

• https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf
• https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4194The The Album and Image Gallery plus Lightbox plugin for Wor…7.3
• CVE-2024-41940A vulnerability has been identified in SINEC NMS (All versio…9.1
• CVE-2024-41941A vulnerability has been identified in SINEC NMS (All versio…4.3
• CVE-2024-41942JupyterHub is software that allows one to create a multi-use…7.2
• CVE-2024-41943I, Librarian is an open-source version of a PDF managing Saa…4.6
• CVE-2024-41944Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41946REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a …7.5
• CVE-2024-41947XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-41948biscuit-java is the java implementation of Biscuit, an authe…5
• CVE-2024-41949biscuit-rust is the Rust implementation of Biscuit, an authe…6.4
• CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x bef…2.7
• CVE-2024-41950Haystack is an end-to-end LLM framework that allows you to b…7.5