Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CWA-2025-002 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.2.0, < 2.2.2 - wasmvm = 2.1.0, < 2.1.5 - wasmvm = 2.0.0, < 2.0.6 - wasmvm < 1.5.8 Patched versions: - wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 Description of the bug The vulnerability can be used to slow down block production. The attack requires a malicious contract, so permissioned chains are unlikely to be affected. (We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27 - 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b - 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58 - 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0 Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m…
Recommended action: Upgrade to 2.2.1, 2.1.6, 2.0.9 or 1.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CWA-2024-007 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.1.0, < 2.1.3 - wasmvm = 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm = 2.1.0, < 2.1.4 - cosmwasm-vm = 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 Patched versions: - wasmvm 1.5.5, 2.0.4, 2.1.3 - cosmwasm-vm 1.5.8, 2.0.7, 2.1.4 Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea - 2.0: https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9 - 2.1: https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492 Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m github.com/CosmWasm/wasmvm 2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you…
Recommended action: Upgrade to 2.1.4, 2.0.7 or 1.5.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CWA-2024-008 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.1.0, < 2.1.3 - wasmvm = 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm = 2.1.0, < 2.1.4 - cosmwasm-vm = 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 Patched versions: - wasmvm 1.5.5, 2.0.4, 2.1.3 - cosmwasm-vm 1.5.8, 2.0.7, 2.1.4 Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/edcdbc520d4f5521eed42de6e2869658278e91fd - 2.0: https://github.com/CosmWasm/cosmwasm/commit/f63429ca59eb44dd5d780c1572016581337091e4 - 2.1: https://github.com/CosmWasm/cosmwasm/commit/108e7dcbf9c21df0fa83f355ad3a7355d7f220cb Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m github.com/CosmWasm/wasmvm 2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you…
Recommended action: Upgrade to 2.1.4, 2.0.7 or 1.5.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see CWA-2023-004.
Recommended action: Upgrade to 1.5.1, 1.4.2, 1.3.4 or 1.2.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. See CWA-2024-004 for more details.
Recommended action: Upgrade to 2.1.2, 2.0.5 or 1.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.