{"id":"CVE-2021-46320","aliases":["CVE-2022-39384","GHSA-88g8-f5mf-f5rj","GHSA-9c22-pwxw-p6hx"],"url":"https://o3.security/vulnerability/CVE-2021-46320","summary":"Improper Initialization in OpenZeppelin","details":"In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.","published":"2022-02-04T12:15:07.623Z","modified":"2026-07-22T03:57:29.793440Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@openzeppelin/contracts","fixedVersion":"4.4.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-22T03:57:29.793440Z"}}