Skip to content
Back to selected findings

Evidence archive · 2016–present

Security Findings & Disclosures

The complete public record behind the portfolio: recent merged fixes, research, and advisories live on the homepage; this page restores the earlier CVE ledger and maps the SolSmith results to Solidity’s official known-bug records in a form that is searchable, linkable, and explicit about classification.

Disclosure summary

55published CVEs
4upstream projects
6memory corruption
47out-of-bounds reads
2logic / DoS

6 memory corruption

Heap or parser-buffer overflow paths

47 out-of-bounds reads

Packet and protocol-parser bounds failures

2 logic / DoS

Validation or abort paths with availability impact

CVE record, advisory, and public finding are different labels

A CVE is the public vulnerability record. A vendor or distributor may separately publish an advisory, and a public finding may instead be documented in a patch, issue, or paper without receiving a CVE. This ledger uses “CVE-backed disclosure” for the 55 assigned records and keeps the 2 non-CVE hardening findings separate. Solidity’s own term is “known security-relevant compiler bugs”; those SOL records are shown in a separate ledger below. Severity is never inferred from an identifier.

Official compiler bug ledger · 2019–2022

7 Solidity security-relevant bugs found by SolSmith

The SolSmith paper documents 25 patched miscompilation bugs found through semantic differential fuzzing. Cross-referencing its linked reports with Solidity’s official docs/bugs.json ledger yields these 7 exact matches. They are security-relevant compiler bug records, not CVEs; the severity and affected version ranges below come from the official ledger.

7official records
5optimizer
1code generation
1front end
  • SOL-2019-1lowIntroduced 0.5.5 · fixed 0.5.6

    DoubleShiftSizeOverflow

    Incorrect optimization

    Nested constant shifts whose combined size overflowed 256 bits could be folded to the wrong value.

    Impact: Incorrect computation in optimized bytecode.

    Trigger: Optimizer enabled; Constantinople-compatible EVM target

    Fuzzer report #6246Solidity notice
  • SOL-2019-2very lowIntroduced 0.5.5 · fixed 0.5.7

    IncorrectByteInstructionOptimization

    Incorrect optimization

    A BYTE optimization rule used the operands in the wrong order when the second argument was 31.

    Impact: Unexpected values in optimized bytecode.

    Trigger: Optimizer enabled; BYTE with constant second argument 31

    Fuzzer report #6316Solidity notice
  • SOL-2020-1medium (0.6.x) · low (0.5.x)0.6.0 → 0.6.1 · 0.5.8 → 0.5.16

    YulOptimizerRedundantAssignmentBreakContinue

    Incorrect optimization

    The redundant-assignment eliminator could remove an essential assignment inside a Yul for-loop.

    Impact: Incorrect computation after a break or continue path.

    Trigger: Yul optimizer; for-loops containing break or continue

    Fuzzer report #8072
  • SOL-2020-9lowIntroduced 0.7.1 · fixed 0.7.2

    FreeFunctionRedefinition

    Front-end validation

    The type checker accepted multiple free functions with the same effective signature.

    Impact: Ambiguous resolution and undefined compiler behavior.

    Trigger: Duplicate or aliased free functions with identical parameter types

    Fuzzer report #9851
  • SOL-2021-1mediumAll prior releases · fixed 0.8.3

    KeccakCaching

    Incorrect optimization

    The bytecode optimizer could reuse a cached Keccak-256 value for a different input length.

    Impact: Incorrect hashes and therefore incorrect computation.

    Trigger: Bytecode optimizer; repeated Keccak-256 over equal content at different lengths

    Fuzzer report #11131Solidity notice
  • SOL-2022-5lowIntroduced 0.0.1 · fixed 0.8.15

    DirtyBytesArrayToStorage

    Code generation / storage

    A partial final word could copy bytes beyond the logical end of a bytes array into storage.

    Impact: Dirty storage became observable after a later push operation.

    Trigger: Legacy code generator; bytes copied from memory or calldata to storage

    Fuzzer report #11602Solidity notice
  • SOL-2022-7medium/highIntroduced 0.8.13 · fixed 0.8.17

    StorageWriteRemovalBeforeConditionalTermination

    Incorrect optimization

    The redundant-store eliminator could remove a storage write before a conditionally terminating call.

    Impact: Incorrect persistent state when the later write was never reached.

    Trigger: Yul optimizer; a called function may terminate with return or stop

    Fuzzer report #13478Solidity notice
Official Solidity bug ledgerSolSmith paper and all 25 findings

2016–2017

Open vSwitch

Packet and OpenFlow parser findings, including remotely reachable code execution, access-control bypass, denial of service, and over-read paths.

6 CVEs

  • CVE-2016-2074Memory corruption

    MPLS parser buffer overflow in ovs-vswitchd.

    Impact: Remote code execution in affected 2.2.x and 2.3.x releases; denial of service in 2.4.x.

  • CVE-2017-9264Out-of-bounds read

    Out-of-bounds reads in the TCP, UDP, and IPv6 parsers.

  • CVE-2016-10377Out-of-bounds read

    Unsigned underflow in the flow parser could read past the packet buffer.

    Impact: Remote access-control-list bypass.

  • CVE-2017-9214Out-of-bounds read

    Out-of-bounds read in an OpenFlow parser.

  • CVE-2017-9263Logic / denial of service

    Unhandled OpenFlow role-status reason reached abort().

    Impact: Remote denial of service from a malicious switch.

  • CVE-2017-9265Out-of-bounds read

    Out-of-bounds read in an OpenFlow parser.

Open vSwitch advisory and reporter acknowledgement

2016–2017

GNU oSIP2

Malformed SIP messages reaching heap-buffer-overflow paths in parsing and serialization code.

4 CVEs

  • CVE-2017-7853Memory corruption

    Heap buffer overflow while parsing a SIP body.

    Impact: Remote denial of service.

  • CVE-2016-10324Memory corruption

    Heap buffer overflow while copying parsed SIP data.

  • CVE-2016-10325Memory corruption

    Heap buffer overflow while serializing a SIP message.

    Impact: Remote denial of service.

  • CVE-2016-10326Memory corruption

    Heap buffer overflow while serializing a SIP body.

    Impact: Remote denial of service.

2017

Snort++

Decoder-array validation findings in the pre-release Snort 3 packet-processing pipeline.

2 CVEs

  • CVE-2017-6657Logic / denial of service

    EtherType validation error could select an incompatible protocol decoder.

    Impact: Remote crash / denial of service.

  • CVE-2017-6658Out-of-bounds read

    Off-by-one decoder-array size permitted a buffer over-read.

Snort vendor acknowledgement

2017

tcpdump

A broad parser audit incorporated into tcpdump 4.9.2: one buffer overflow and 42 buffer over-reads across network-protocol dissectors.

43 CVEs

  • CVE-2017-13011Memory corruption

    Buffer overflow in util-print.c:bittok2str_internal().

  • CVE-2017-13012Out-of-bounds read

    ICMP parser over-read in icmp_print().

  • CVE-2017-13013Out-of-bounds read

    ARP parser over-read in print-arp.c.

  • CVE-2017-13015Out-of-bounds read

    EAP parser over-read in eap_print().

  • CVE-2017-13016Out-of-bounds read

    ISO ES-IS parser over-read in esis_print().

  • CVE-2017-13017Out-of-bounds read

    DHCPv6 parser over-read in dhcp6opt_print().

  • CVE-2017-13018Out-of-bounds read

    PGM parser over-read in pgm_print().

  • CVE-2017-13019Out-of-bounds read

    PGM parser over-read in pgm_print().

  • CVE-2017-13020Out-of-bounds read

    VTP parser over-read in vtp_print().

  • CVE-2017-13021Out-of-bounds read

    ICMPv6 parser over-read in icmp6_print().

  • CVE-2017-13022Out-of-bounds read

    IP parser over-read in ip_printroute().

  • CVE-2017-13023Out-of-bounds read

    IPv6 mobility parser over-read in mobility_opt_print().

  • CVE-2017-13024Out-of-bounds read

    IPv6 mobility parser over-read in mobility_opt_print().

  • CVE-2017-13025Out-of-bounds read

    IPv6 mobility parser over-read in mobility_opt_print().

  • CVE-2017-13026Out-of-bounds read

    ISO IS-IS parser over-read in print-isoclns.c.

  • CVE-2017-13027Out-of-bounds read

    LLDP parser over-read in lldp_mgmt_addr_tlv_print().

  • CVE-2017-13028Out-of-bounds read

    BOOTP parser over-read in bootp_print().

  • CVE-2017-13029Out-of-bounds read

    PPP parser over-read in print_ccp_config_options().

  • CVE-2017-13030Out-of-bounds read

    PIM parser over-read in print-pim.c.

  • CVE-2017-13031Out-of-bounds read

    IPv6 fragmentation-header parser over-read in frag6_print().

  • CVE-2017-13032Out-of-bounds read

    RADIUS parser over-read in print_attr_string().

  • CVE-2017-13033Out-of-bounds read

    VTP parser over-read in vtp_print().

  • CVE-2017-13034Out-of-bounds read

    PGM parser over-read in pgm_print().

  • CVE-2017-13035Out-of-bounds read

    ISO IS-IS parser over-read in isis_print_id().

  • CVE-2017-13036Out-of-bounds read

    OSPFv3 parser over-read in ospf6_decode_v3().

  • CVE-2017-13037Out-of-bounds read

    IP parser over-read in ip_printts().

  • CVE-2017-13039Out-of-bounds read

    ISAKMP parser over-read in print-isakmp.c.

  • CVE-2017-13042Out-of-bounds read

    HNCP parser over-read in dhcpv6_print().

  • CVE-2017-13043Out-of-bounds read

    BGP parser over-read in decode_multicast_vpn().

  • CVE-2017-13044Out-of-bounds read

    HNCP parser over-read in dhcpv4_print().

  • CVE-2017-13688Out-of-bounds read

    OLSR parser over-read in olsr_print().

  • CVE-2017-13045Out-of-bounds read

    VQP parser over-read in vqp_print().

  • CVE-2017-13046Out-of-bounds read

    BGP parser over-read in bgp_attr_print().

  • CVE-2017-13047Out-of-bounds read

    ISO ES-IS parser over-read in esis_print().

  • CVE-2017-13048Out-of-bounds read

    RSVP parser over-read in rsvp_obj_print().

  • CVE-2017-13050Out-of-bounds read

    RPKI-Router parser over-read in rpki_rtr_pdu_print().

  • CVE-2017-13689Out-of-bounds read

    IKEv1 parser over-read in ikev1_id_print().

  • CVE-2017-13690Out-of-bounds read

    IKEv2 parser over-read in print-isakmp.c.

  • CVE-2017-13051Out-of-bounds read

    RSVP parser over-read in rsvp_obj_print().

  • CVE-2017-13055Out-of-bounds read

    ISO IS-IS parser over-read in isis_print_is_reach_subtlv().

  • CVE-2017-13052Out-of-bounds read

    CFM parser over-read in cfm_print().

  • CVE-2017-13053Out-of-bounds read

    BGP parser over-read in decode_rt_routing_info().

  • CVE-2017-13054Out-of-bounds read

    LLDP parser over-read in lldp_private_8023_print().

tcpdump 4.9.2 release record

Public, without a CVE

Additional findings

Jul 2026

Supranational blst

Two safe-Rust memory-safety issues in the blst Rust bindings

Privately reported two issues in the blst 0.3.16 Rust bindings, both reachable from safe Rust and reproduced under AddressSanitizer: Pairing stored a raw pointer to a borrowed DST slice and could read freed memory after the slice was dropped, and Pairing::mul_n_aggregate (and the high-level verify_multiple_aggregate_signatures) accepted an nbits value unchecked against the scalar slice length, allowing out-of-bounds reads. The maintainer fixed both — a DST lifetime bound on Pairing and a scalar-length check that panics on mismatch. Reporter and maintainer agreed these are hardening fixes rather than a security issue: the affected parameters are fixed at application design time and not attacker-controlled, and downstream use in Lighthouse v8.2.0 was checked and not affected.

Fix: bind DST lifetime to PairingFix: harden Pairing.mul_n_aggregate interface

May 2017

Open vSwitch / OVN

Truncated DHCPv6 and DNS packet validation in pinctrl

Added missing full-header checks before pinctrl read UDP length and payload fields. The maintainer judged the normal installed path not exploitable, so this remains a public hardening finding rather than a CVE.