What’s Vulnerable › Vulnerabilities

CVE-2023-36184

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-08 · updated 2026-06-17
• Weakness: CWE-787

Description

CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.

Affected products

• Aptosfoundation Aptos: before 1.4.3 — fixed in 1.4.3
• Move Project Move: all versions
• Mystenlabs Sui: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: Aptosfoundation Aptos 1.4.3; Mystenlabs Sui 1.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/MystenLabs/sui/commit/8b681515c0cf435df2a54198a28ab4ef574d202b
• https://github.com/aptos-labs/aptos-core/commit/47a0391c612407fe0b1051ef658a29e35d986963
• https://github.com/move-language/move/issues/1059
• https://medium.com/%40Beosin_com/critical-vulnerability-in-move-vm-can-cause-total-network-shutdown-and-potential-hard-fork-in-sui-49d0d942801c
• https://github.com/MystenLabs/sui/commit/8b681515c0cf435df2a54198a28ab4ef574d202b
• https://github.com/aptos-labs/aptos-core/commit/47a0391c612407fe0b1051ef658a29e35d986963
• https://github.com/move-language/move/issues/1059
• https://medium.com/%40Beosin_com/critical-vulnerability-in-move-vm-can-cause-total-network-shutdown-and-potential-hard-fork-in-sui-49d0d942801c

Get alerted when CVE-2023-36184 or the next vulnerability affects your stack