{"id":"CVE-2021-46320","details":"In OpenZeppelin \u003c=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.","aliases":["CVE-2022-39384","GHSA-88g8-f5mf-f5rj","GHSA-9c22-pwxw-p6hx"],"modified":"2026-07-22T03:57:29.793440Z","published":"2022-02-04T12:15:07.623Z","references":[{"type":"ADVISORY","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openzeppelin/openzeppelin-contracts","events":[{"introduced":"1ada3b633e5bfd9d4ffe0207d64773a11f5a7c40"},{"last_affected":"4961a51cc736c7d4aa9bd2e11e4cbbaff73efee9"}],"database_specific":{"cpe":"cpe:2.3:a:openzeppelin:openzeppelin:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.2.0"},{"last_affected":"4.4.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46320.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}