CVE-2024-58131 Race condition in FISCO-BCOS

What is CVE-2024-58131?

CVE-2024-58131 is a medium-severity vulnerability in FISCO-BCOS, published on 6 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the codebase to allow a large min_seal_time value) joins a blockchain network.

Weakness: CWE-662, CWE-821

Which versions are affected by CVE-2024-58131?

It affects 1 product.

Products include Fisco-Bcos Fisco-Bcos.

How do I fix CVE-2024-58131?

No fix has been published for CVE-2024-58131 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-58131 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58131 exists.

Other vulnerabilities in FISCO-BCOS

• CVE-2022-28936 Integer overflow in n/a High 7.5
• CVE-2022-28937 Denial of service in n/a High 7.5
• CVE-2022-26534 Denial of service in n/a High 7.5
• CVE-2021-46359 Business logic in n/a High 7.5
• CVE-2021-35041 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j882-wwwr-7r6q.