CVE-2018-15890

CRITICAL

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new bloc...

Affects 1 product across 1 vendor.

CVSS 3.09.8
EPSS2.9%
Percentile87th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Ethereum systems (CVE-2018-15890). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-208891-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-15890?
This vulnerability was disclosed in 2019. A critical vulnerability affects Ethereum systems (CVE-2018-15890). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-15890?
CVE-2018-15890 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.9%.
Is CVE-2018-15890 actively exploited?
No confirmed active exploitation of CVE-2018-15890 as of 2026-05-30.
How do I remediate CVE-2018-15890?
Priority: MEDIUM.
What systems are affected by CVE-2018-15890?
CVE-2018-15890 affects Ethereum Ethereumj.
Vulnerability Details
CVE IDCVE-2018-15890
BSIDBS-2019-GLOBAL-208891-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2019-06-20
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Ethereum Ethereumj 1.8.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2674 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashc452b5f6ee1ed719716912c23b5f0495b06a9e039c7dff97873de587c4b19b659ee136958f9e65c6e0b4f6f7dfde2b27b50df030909445809ca9784701ad558f
Related CVEs affecting Ethereum
CVE-2017-14451 10.0 An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Vi... CVE-2024-51427 9.8 An issue in the PepeGxng smart contract (which can be run on the Ethereum blo... CVE-2024-51424 9.8 An issue in the PepeGxng smart contract (which can be run on the Ethereum blo... CVE-2018-18920 8.8 Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call th... CVE-2024-51425 8.8 An issue in the WaterToken smart contract (which can be run on the Ethereum b...
View all Ethereum CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →