CVE intelligence and bounded remediation

CVE-2022-35915 — OpenZeppelin Contracts is a library for secure smart contract development

Medium CVSS 5.3

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: Medium
CVSS: 5.3 (3.1)
Published: 2022-08-01
CISA KEV: Not currently listed
Ecosystem: software/application
Weaknesses: CWE-400, CWE-770

Affected products

openzeppelin / contracts
openzeppelin / contracts_upgradeable
openzeppelin / openzeppelin-eth
openzeppelin / openzeppelin-solidity

Matched remediation archetype

Resource exhaustion and denial of service

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

Identify attacker-influenced work factors including input size, nesting, compression, fan-out, regex cost, allocation, recursion, retries, and connection lifetime.
Map per-request and shared CPU, memory, disk, descriptor, thread, queue, and downstream-service limits.
Determine whether authentication, tenancy, quotas, and rate controls apply before expensive processing begins.

Remediate safely

Bound input size, nesting, expansion, work, concurrency, queue depth, retries, and execution time before resource-intensive processing.
Release resources on every success, error, cancellation, and timeout path and use backpressure instead of unbounded buffering.
Update affected components and add small deterministic tests that assert resource ceilings rather than exhausting a host.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.