Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2022-36025 — besu

🔴 CVSS 9.5 — Critical ✅ No Known Exploit CWE-196 NVD
9.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Besu VM vulnerable to gas allocation error in CALL operations

Impact

An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations.

In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations.

Patches

Version 22.7.1 contains a fix, ensuring that excess gas will not be allocated to inner transaction calls and correcting the excess gas errors.

Workarounds

Reverting to version 22.1.3 or earlier will prevent incorrect execution. However many ethereum mainnet networks require changes in more recent versions of Besu and should not use older versions of besu and should instead use the patched version.

Ethereum Classic and other networks not depending on a Proof of Stake transition should function fine with version 22.1.3 or earlier.

For more information

Issue was found by [Martin Holst Swende](https://github.com/holiman) using [goevmlab](https://github.com/holiman/goevmlab), it is believed that no production networks have transactions that would trigger this failure.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Attack vector: Network — reachable from anywhere that can route to the service.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: None — an unauthenticated stranger can try it.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: High — total loss, or loss the attacker controls.
  • Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2022-36025 is classified as CWE-196: Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.

Affected software

CVE-2022-36025 is recorded against 2 packages.

  • besu
  • org.hyperledger.besu:evm (from 22.4.0-RC1 up to 22.7.1)

Timeline and source

Published on 24 September 2022 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com
github.com

Same weakness in other software

These advisories are the same class of weakness (CWE-196: Unsigned to Signed Conversion Error) in other software:

Details

Severity CRITICAL
CVSS Score 9.5
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE CWE-196
Public Exploit ✅ No
Source NVD
Published 2022-09-24
Updated 2026-08-20
Modified 2026-06-17
Fix URL N/A

Affected Packages

Software From version Fixed in
besu — —
org.hyperledger.besu:evm 22.4.0-RC1 22.7.1

Exploit Protection

Are you running besu?

CVE-2022-36025 carries CVSS 9.5 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2022-36025 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2022
✓