274 matches found
Malicious code in ens-namehash-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b2ef072c91f8f3543ffbe2c1058ad379782fece91aac0f3cd1eac6a931f60f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15980 Malicious code in ens-namehash-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b2ef072c91f8f3543ffbe2c1058ad379782fece91aac0f3cd1eac6a931f60f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview ens-namehash-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things IoT botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service DDoS attacks. The new version, tracked as Kimwolf v7, wa...
bigchaindb-common (0.0.2.dev1), ens-namehash (1.0.0) +1 more potentially affected by CVE-2022-37454 via pysha3 (0.3.0)
pysha3 PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysha3 and may be impacted: - bigchaindb-common 0.0.2.dev1 - ens-namehash 1.0.0 - web3 =1.5.0, =1.6.0 Source cves: CVE-2022-37454 Source advisory: OSV:PYSEC-2026-504...
CVE-2026-22866
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check...
GHSA-C6RR-7PMC-73WC ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Impact The RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check if the last 32 or 20 bytes of the decrypted signature match the expected hash. This enables Bleichenbacher's 2006 signature forgery...
@cartesi/rollups (2.0.0-rc.3), @guidanoli/cmioc (>=0.1.4-beta.1, <=0.2.1) +5 more potentially affected by CVE-2026-22866 via @ensdomains/ens-contracts (>=1.0.0, <=1.2.2)
@ensdomains/ens-contracts NPM version =1.0.0, =0.1.4-beta.1, =0.1.5, =0.0.6, =0.0.4, =100.2.5-beta.0, =0.4.0, =0.9.0 Source cves: CVE-2026-22866 Source advisory: OSV:GHSA-C6RR-7PMC-73WC...
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Impact The RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check if the last 32 or 20 bytes of the decrypted signature match the expected hash. This enables Bleichenbacher's 2006 signature forgery...
EUVD-2026-8679
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS1 v1.5 Padding Validation...
@cartesi/rollups (2.0.0-rc.3), @guidanoli/cmioc (>=0.1.4-beta.1, <=0.2.1) +5 more potentially affected by CVE-2026-22866 via @ensdomains/ens-contracts (>=1.0.0, <=1.2.2)
@ensdomains/ens-contracts NPM version =1.0.0, =0.1.4-beta.1, =0.1.5, =0.0.6, =0.0.4, =100.2.5-beta.0, =0.4.0, =0.9.0 Source cves: CVE-2026-22866 Source advisory: GHSA-C6RR-7PMC-73WC...
CVE-2026-22866 ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check...
CVE-2026-22866 ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check...
CVE-2026-22866: Improper Verification of Cryptographic Signature
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check...
PT-2026-21935
Name of the Vulnerable Software and Affected Versions Ethereum Name Service ENS versions 1.6.2 and prior Description The RSASHA256Algorithm and RSASHA1Algorithm contracts do not properly validate PKCS1 v1.5 padding when verifying RSA signatures. The contracts only verify the final 32 or 20 bytes ...
Malicious Package
Overview ens-austt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
EUVD-2025-198976
Malicious code in @ensdomains/op-resolver-contracts npm...
MAL-2025-190932 Malicious code in @ensdomains/ens-test-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3393f85554fe6141b0f72e2f23d0940b102522348e71f60d407dc1471de8f6a9 The package @ensdomains/ens-test-env was found to contain malicious code. Source: ghsa-malware...
Malicious code in @ensdomains/ens-test-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3393f85554fe6141b0f72e2f23d0940b102522348e71f60d407dc1471de8f6a9 The package @ensdomains/ens-test-env was found to contain malicious code. Source: ghsa-malware...