CVE-2022-35913

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim must try to collaborate with the attacker for a Stonewallx2 transaction. Next, the attacker broadcasts a tx, spending the inputs used in Stonewallx2 before the victim can broadcast the collaborative transaction. The attacker does not signal opt in RBF, and uses the lowest fee rate. This would result in the victim being unable to perform Stonewallx2. (Note that the attacker could use multiple paynyms.)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-359149.8/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.CVE-2022-359155.3OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cCVE-2022-359165.3OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossCVE-2022-359175.3Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps aCVE-2022-359186.5Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulCVE-2022-359192.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users autCVE-2022-35926.5A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured shCVE-2022-359207.5Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` iCVE-2022-359214.3fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement byCVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ouCVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in thCVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider`