HOME VULNERABILITIESCVE-2021-39193

MEDIUM

CVE-2021-39193

CWE-20Published: September 3, 2021· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch.

Technical Analysis

CVE-2021-39193 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Vendors & Products

parity1 product(s)

frontier

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26

PATCHhttps://github.com/paritytech/frontier/pull/465

PATCHhttps://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849ae

PATCHhttps://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xm

PATCHhttps://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26

PATCHhttps://github.com/paritytech/frontier/pull/465

PATCHhttps://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849ae

PATCHhttps://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xm

All References (8)

→

https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26Patch · Third Party Advisory

→

https://github.com/paritytech/frontier/pull/465Patch · Third Party Advisory

→

https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849aePatch · Third Party Advisory

→

https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xmPatch · Third Party Advisory

→

https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26Patch · Third Party Advisory

→

https://github.com/paritytech/frontier/pull/465Patch · Third Party Advisory

→

https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849aePatch · Third Party Advisory

→

https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xmPatch · Third Party Advisory

Quick Facts

CVE IDCVE-2021-39193

CVSS Score5.3 / 10

SeverityMEDIUM

WeaknessCWE-20

CISA KEVNo

Affected1 vendor(s)

PublishedSep 3, 2021

Related CVEs (CWE-20)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2021-39193 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2021-39193·NVD