CVE-2021-41264 - CVE House
Back to Database
Status published Critical CVE-2021-41264

UUPSUpgradeable vulnerability in OpenZeppelin Contracts

Vulnerability Description

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41264

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenZeppelin

View All →
CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
Medium 6.9
CVE-2024-45304
OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts
Medium 5.3
CVE-2024-27094
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Medium 6.5
CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts
Medium 5.9
CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
Medium 5.3

Affected Vendor

OpenZeppelin

View all reports →

Affected Software

openzeppelin-contracts
Vulnerable Versions:
>= 4.1.0 < 4.3.2

Timeline

Official Publish: November 12th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-665

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.