CVE-2023-34449

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-253CWE-754

Affected software

No affected versions have been published.

Timeline

Published
Jun 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-34454.8Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.CVE-2023-344505.3CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internaCVE-2023-344518.2CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. The mempooCVE-2023-344526.1Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scrCVE-2023-344537.5snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior toCVE-2023-344547.5snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior toCVE-2023-344557.5snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in vCVE-2023-344577.5MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicioCVE-2023-344585.3mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, iCVE-2023-344595.9OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMuCVE-2023-34465.3Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_cheCVE-2023-344609.8Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope