How severe is CVE-2022-39242?

CVE-2022-39242 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2022-39242 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-39242?

CVE-2022-39242 affects Parity Frontier. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-39242?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-39242 published?

CVE-2022-39242 was published on 2022-09-24 and last updated on 2026-06-17.

CVE-2022-39242

CVE-2022-39242 is a medium-severity vulnerability in Parity Frontier with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-682.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-682
Affected product: Parity Frontier
Published: 2022-09-24
Last modified: 2026-06-17

Description

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.

Frequently asked questions

What is CVE-2022-39242?: Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.
How severe is CVE-2022-39242?: CVE-2022-39242 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2022-39242 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-39242?: CVE-2022-39242 affects Parity Frontier. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-39242?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-39242 published?: CVE-2022-39242 was published on 2022-09-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:*

More vulnerabilities in Parity Frontier

CVE-2023-45130 — High (CVSS 7.5): Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the…
CVE-2023-28431 — High (CVSS 7.5): Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under…
CVE-2022-36008 — High (CVSS 7.1): Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC…
CVE-2022-21685 — Medium (CVSS 6.5): Frontier is Substrate's Ethereum compatibility layer. Prior to commit number…
CVE-2022-31111 — Medium (CVSS 5.3): Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between…
CVE-2021-41138 — Medium (CVSS 5.3): Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for…

All CVEs affecting Parity Frontier →

Other CWE-682 vulnerabilities

CVE-2023-2163 — Critical (CVSS 10.0): Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe,…
CVE-2026-1229 — Critical (CVSS 9.8): The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific…
CVE-2024-36736 — Critical (CVSS 9.8): An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same…
CVE-2022-30600 — Critical (CVSS 9.8): A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout…
CVE-2021-44847 — Critical (CVSS 9.8): A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through…
CVE-2020-0221 — Critical (CVSS 9.8): Airbrush FW's scratch memory allocator is susceptible to numeric overflow. When the overflow occurs, the next…

Browse all CWE-682 vulnerabilities →