CVE-2022-35961
published 2022-08-15CVE-2022-35961: OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.34%
25.8th percentile
OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments. The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection. The issue has been patched in 4.7.3.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| digitalbazaar | forge | < 1.4.0 | 1.4.0 |
| digitalbazaar | forge | <= 1.3.3 | — |
| openzeppelin | contracts | >= 4.1.0 < 4.7.3 | 4.7.3 |
| openzeppelin | contracts | >= 4.1.0 < 4.7.3 | 4.7.3 |
| openzeppelin | contracts-upgradeable | >= 4.1.0 < 4.7.3 | 4.7.3 |
| openzeppelin | contracts_upgradeable | >= 4.1.0 < 4.7.3 | 4.7.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_redhat7.9HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-33895: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
osv·2026-03-27·CVSS 6.5
CVE-2026-33895 [MEDIUM] CVE-2026-33895: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.
OSV
Forge has signature forgery in Ed25519 due to missing S > L check
osv·2026-03-26·CVSS 6.5
CVE-2026-33895 [MEDIUM] Forge has signature forgery in Ed25519 due to missing S > L check
Forge has signature forgery in Ed25519 due to missing S > L check
## Summary
Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, [as defined by the specification](https://datatracker.ietf.org/doc/html/rfc8032#section-8.4). This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see [CVE-2026-25793](https://nvd.nist.gov/vuln/detail/CVE-2026-25793), [CVE-2022-35961](https://nvd.nist.gov/vuln/detail/CVE-2022-35961)). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracki
GHSA
Forge has signature forgery in Ed25519 due to missing S > L check
ghsa·2026-03-26·CVSS 6.5
CVE-2026-33895 [MEDIUM] CWE-347 Forge has signature forgery in Ed25519 due to missing S > L check
Forge has signature forgery in Ed25519 due to missing S > L check
## Summary
Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, [as defined by the specification](https://datatracker.ietf.org/doc/html/rfc8032#section-8.4). This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see [CVE-2026-25793](https://nvd.nist.gov/vuln/detail/CVE-2026-25793), [CVE-2022-35961](https://nvd.nist.gov/vuln/detail/CVE-2022-35961)). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracki
OSV
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
osv·2022-08-18
CVE-2022-35961 [HIGH] OpenZeppelin Contracts vulnerable to ECDSA signature malleability
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
### Impact
The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments.
The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection.
### Patches
The issue has been patched
GHSA
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
ghsa·2022-08-18
CVE-2022-35961 [HIGH] CWE-354 OpenZeppelin Contracts vulnerable to ECDSA signature malleability
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
### Impact
The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments.
The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection.
### Patches
The issue has been patched
Red Hat
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
vendor_redhat·2026-03-27·CVSS 7.9
CVE-2026-33895 [HIGH] CWE-347 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicali
No detection rules found.
No public exploits indexed.
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3610https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.3https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4h98-2769-gh6hhttps://github.com/OpenZeppelin/openzeppelin-contracts/pull/3610https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.3https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4h98-2769-gh6h
2022-08-15
Published