{"id":"CVE-2021-41153","aliases":[],"url":"https://o3.security/vulnerability/CVE-2021-41153","summary":"Specification non-compliance in JUMPI","details":"### Impact \n\nIn `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check.\n\n### Patches\n\nThis is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`.\n\nThis is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.\n\n### Workarounds\n\nIf you are dependent on an older version of `evm` and cannot update due to API interface changes, please contact Wei by email (wei@that.world), who will be happy to help you to publish patch releases for older `evm` versions.\n\n### References\n\nFix PR: https://github.com/rust-blockchain/evm/pull/67\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in the `evm` repo.\n\n### Special thanks\n\nSpecial thanks to @rakita for reporting this issue.\n","published":"2021-10-19T15:28:35Z","modified":"2026-05-04T08:46:04.410594935Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"evm","fixedVersion":"0.31.0"}],"fix":{"url":"https://github.com/rust-blockchain/evm/pull/67","label":"rust-blockchain/evm#67"},"references":[{"type":"WEB","url":"https://github.com/rust-blockchain/evm/security/advisories/GHSA-pvh2-pj76-4m96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41153"},{"type":"WEB","url":"https://github.com/rust-blockchain/evm/pull/67"},{"type":"PACKAGE","url":"https://github.com/rust-blockchain/evm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-04T08:46:04.410594935Z"}}