CVE-2021-43667

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hyperledger/fabric/pull/2844Patch, Third Party Advisory
https://jira.hyperledger.org/browse/FAB-18529Exploit, Vendor Advisory
https://github.com/hyperledger/fabric/pull/2844Patch, Third Party Advisory
https://jira.hyperledger.org/browse/FAB-18529Exploit, Vendor Advisory

Timeline

Published: Nov 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-436685.5Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runti CVE-2021-436697.5A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the att CVE-2021-43675.4The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using CVE-2021-436736.1dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is p CVE-2021-436749.8ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products tha CVE-2021-436756.1Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the scr CVE-2021-436769.8matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.CVE-2021-436776.1Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-436786.1Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.CVE-2021-436799.8ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.CVE-2021-43688.8The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This i CVE-2021-436816.1SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will termi