CVE-2024-27094: Openzeppelin Contracts

High severity, CVSS 7.4. EPSS: 0.8% chance of exploitation in the next 30 days.

OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.

Affected products

• Openzeppelin Contracts: from 4.5.0, before 4.9.6 (fixed in 4.9.6); from 5.0.0, before 5.0.2 (fixed in 5.0.2)
• Openzeppelin Contracts Upgradeable: from 4.5.0, up to and including 4.9.6; from 5.0.0, before 5.0.2 (fixed in 5.0.2)

Published 2024-03-21. Last modified 2026-06-17.