CVE-2022-36023 Remote denial of service in Hyperledger Fabric Gateway

What is CVE-2022-36023?

CVE-2022-36023 is a high-severity vulnerability in hyperledger fabric, published on 18 Aug 2022.

Official description

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.

Weakness: CWE-20

Which versions are affected by CVE-2022-36023?

5 open source packages ship an affected version, including github.com/hyperledger/fabric, hyperledger-fabric-orderer and hyperledger-fabric-peer. It affects 1 product.

Products include Hyperledger Fabric.

How do I fix CVE-2022-36023?

Upgrade github.com/hyperledger/fabric to 2.4.6 or later.

Is CVE-2022-36023 being exploited?

There is no known exploitation of CVE-2022-36023 in the wild and no public exploit code.

Other vulnerabilities in hyperledger fabric

• CVE-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE Critical 9.3
• CVE-2022-45196 Denial of service in n/a High 7.5
• CVE-2022-31121 Improper Input Validation in fabric hyperledger High 7.5
• CVE-2023-46132 Crosslinking transaction attack in hyperledger/fabric High 7.1
• CVE-2024-45244 Hyperledger Fabric does not verify request has a timestamp within the expected time window Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-hyperledger-fabric-orderer-2022-36023, BIT-hyperledger-fabric-peer-2022-36023, BIT-hyperledger-fabric-tools-2022-36023, GHSA-qj6r-fhrc-jj5r.