Evidence archive · 2016–present
The complete public record behind the portfolio: recent merged fixes, research, and advisories live on the homepage; this page restores the earlier CVE ledger and maps the SolSmith results to Solidity’s official known-bug records in a form that is searchable, linkable, and explicit about classification.
6 memory corruption
Heap or parser-buffer overflow paths
47 out-of-bounds reads
Packet and protocol-parser bounds failures
2 logic / DoS
Validation or abort paths with availability impact
A CVE is the public vulnerability record. A vendor or distributor may separately publish an advisory, and a public finding may instead be documented in a patch, issue, or paper without receiving a CVE. This ledger uses “CVE-backed disclosure” for the 55 assigned records and keeps the non-CVE pinctrl fix separate. Solidity’s own term is “known security-relevant compiler bugs”; those SOL records are shown in a separate ledger below. Severity is never inferred from an identifier.
Official compiler bug ledger · 2019–2022
The SolSmith paper documents 25 patched miscompilation bugs found through semantic differential fuzzing. Cross-referencing its linked reports with Solidity’s official docs/bugs.json ledger yields these 7 exact matches. They are security-relevant compiler bug records, not CVEs; the severity and affected version ranges below come from the official ledger.
Nested constant shifts whose combined size overflowed 256 bits could be folded to the wrong value.
Impact: Incorrect computation in optimized bytecode.
Trigger: Optimizer enabled; Constantinople-compatible EVM target
A BYTE optimization rule used the operands in the wrong order when the second argument was 31.
Impact: Unexpected values in optimized bytecode.
Trigger: Optimizer enabled; BYTE with constant second argument 31
The redundant-assignment eliminator could remove an essential assignment inside a Yul for-loop.
Impact: Incorrect computation after a break or continue path.
Trigger: Yul optimizer; for-loops containing break or continue
The type checker accepted multiple free functions with the same effective signature.
Impact: Ambiguous resolution and undefined compiler behavior.
Trigger: Duplicate or aliased free functions with identical parameter types
The bytecode optimizer could reuse a cached Keccak-256 value for a different input length.
Impact: Incorrect hashes and therefore incorrect computation.
Trigger: Bytecode optimizer; repeated Keccak-256 over equal content at different lengths
A partial final word could copy bytes beyond the logical end of a bytes array into storage.
Impact: Dirty storage became observable after a later push operation.
Trigger: Legacy code generator; bytes copied from memory or calldata to storage
The redundant-store eliminator could remove a storage write before a conditionally terminating call.
Impact: Incorrect persistent state when the later write was never reached.
Trigger: Yul optimizer; a called function may terminate with return or stop
2016–2017
Packet and OpenFlow parser findings, including remotely reachable code execution, access-control bypass, denial of service, and over-read paths.
6 CVEs
MPLS parser buffer overflow in ovs-vswitchd.
Impact: Remote code execution in affected 2.2.x and 2.3.x releases; denial of service in 2.4.x.
Out-of-bounds reads in the TCP, UDP, and IPv6 parsers.
Unsigned underflow in the flow parser could read past the packet buffer.
Impact: Remote access-control-list bypass.
Out-of-bounds read in an OpenFlow parser.
Unhandled OpenFlow role-status reason reached abort().
Impact: Remote denial of service from a malicious switch.
Out-of-bounds read in an OpenFlow parser.
2016–2017
Malformed SIP messages reaching heap-buffer-overflow paths in parsing and serialization code.
4 CVEs
Heap buffer overflow while parsing a SIP body.
Impact: Remote denial of service.
Heap buffer overflow while copying parsed SIP data.
Heap buffer overflow while serializing a SIP message.
Impact: Remote denial of service.
Heap buffer overflow while serializing a SIP body.
Impact: Remote denial of service.
2017
Decoder-array validation findings in the pre-release Snort 3 packet-processing pipeline.
2 CVEs
EtherType validation error could select an incompatible protocol decoder.
Impact: Remote crash / denial of service.
Off-by-one decoder-array size permitted a buffer over-read.
2017
A broad parser audit incorporated into tcpdump 4.9.2: one buffer overflow and 42 buffer over-reads across network-protocol dissectors.
43 CVEs
Buffer overflow in util-print.c:bittok2str_internal().
ICMP parser over-read in icmp_print().
ARP parser over-read in print-arp.c.
EAP parser over-read in eap_print().
ISO ES-IS parser over-read in esis_print().
DHCPv6 parser over-read in dhcp6opt_print().
PGM parser over-read in pgm_print().
PGM parser over-read in pgm_print().
VTP parser over-read in vtp_print().
ICMPv6 parser over-read in icmp6_print().
IP parser over-read in ip_printroute().
IPv6 mobility parser over-read in mobility_opt_print().
IPv6 mobility parser over-read in mobility_opt_print().
IPv6 mobility parser over-read in mobility_opt_print().
ISO IS-IS parser over-read in print-isoclns.c.
LLDP parser over-read in lldp_mgmt_addr_tlv_print().
BOOTP parser over-read in bootp_print().
PPP parser over-read in print_ccp_config_options().
PIM parser over-read in print-pim.c.
IPv6 fragmentation-header parser over-read in frag6_print().
RADIUS parser over-read in print_attr_string().
VTP parser over-read in vtp_print().
PGM parser over-read in pgm_print().
ISO IS-IS parser over-read in isis_print_id().
OSPFv3 parser over-read in ospf6_decode_v3().
IP parser over-read in ip_printts().
ISAKMP parser over-read in print-isakmp.c.
HNCP parser over-read in dhcpv6_print().
BGP parser over-read in decode_multicast_vpn().
HNCP parser over-read in dhcpv4_print().
OLSR parser over-read in olsr_print().
VQP parser over-read in vqp_print().
BGP parser over-read in bgp_attr_print().
ISO ES-IS parser over-read in esis_print().
RSVP parser over-read in rsvp_obj_print().
RPKI-Router parser over-read in rpki_rtr_pdu_print().
IKEv1 parser over-read in ikev1_id_print().
IKEv2 parser over-read in print-isakmp.c.
RSVP parser over-read in rsvp_obj_print().
ISO IS-IS parser over-read in isis_print_is_reach_subtlv().
CFM parser over-read in cfm_print().
BGP parser over-read in decode_rt_routing_info().
LLDP parser over-read in lldp_private_8023_print().
Public, without a CVE
May 2017
Open vSwitch / OVN
Added missing full-header checks before pinctrl read UDP length and payload fields. The maintainer judged the normal installed path not exploitable, so this remains a public hardening finding rather than a CVE.