Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
2.0.0-20250204103256-d62c3b826a9d2.0.62.1.52.2.22.0.6-0.20250204103256-d62c3b826a9d· Vendor fix available
Issue
CWA-2025-002 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.2.0, < 2.2.2 - wasmvm = 2.1.0, < 2.1.5 - wasmvm = 2.0.0, < 2.0.6 - wasmvm < 1.5.8 Patched versions: - wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 Description of the bug The vulnerability can be used to slow down block production. The attack requires a malicious contract, so permissioned chains are unlikely to be affected. (We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27 - 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b - 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58 - 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0 Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m…
Recommended action: Upgrade to 2.2.2, 2.1.5, 2.0.6-0.20250204103256-d62c3b826a9d (pre-release) or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CWA-2025-001 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.2.0, < 2.2.2 - wasmvm = 2.1.0, < 2.1.5 - wasmvm = 2.0.0, < 2.0.6 - wasmvm < 1.5.8 Patched versions: - wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 Description of the bug The vulnerability can be used to crash the chain. The underlying bug that causes this is present on both permissioned and premissionless chains, but it can only be triggered reliably with a malicious contract, so permissioned chains are much less likely to be affected. (We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/wasmvm/commit/1151bc6df7d02d1889b8da37cf8510eaf4198eea - 2.0: https://github.com/CosmWasm/wasmvm/commit/d4ff2adee44e6b9f7415a5dfbb3de745ab9b7678 - 2.1: https://github.com/CosmWasm/wasmvm/commit/8d44a286fabc793a2fba93752e58cd0fd5b88a2d - 2.2: https://github.com/CosmWasm/wasmvm/commit/0aefa4c378457aeb3c07e7975b875be38872c56d Applying the patch The patch will be shipped in releases…
Recommended action: Upgrade to 2.2.2, 2.1.5 or 2.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/CosmWasm/wasmvm/v2 >= 2.1.0, < 2.1.3; >= 2.0.0, < 2.0.4
Fixed in
2.1.32.0.4· Vendor fix available
Issue
CWA-2024-007 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.1.0, < 2.1.3 - wasmvm = 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm = 2.1.0, < 2.1.4 - cosmwasm-vm = 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 Patched versions: - wasmvm 1.5.5, 2.0.4, 2.1.3 - cosmwasm-vm 1.5.8, 2.0.7, 2.1.4 Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea - 2.0: https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9 - 2.1: https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492 Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m github.com/CosmWasm/wasmvm 2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you…
Recommended action: Upgrade to 2.1.3 or 2.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/CosmWasm/wasmvm/v2 >= 2.1.0, < 2.1.3; >= 2.0.0, < 2.0.4
Fixed in
2.1.32.0.4· Vendor fix available
Issue
CWA-2024-008 Severity Medium (Moderate + Likely)[^1] Affected versions: - wasmvm = 2.1.0, < 2.1.3 - wasmvm = 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm = 2.1.0, < 2.1.4 - cosmwasm-vm = 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 Patched versions: - wasmvm 1.5.5, 2.0.4, 2.1.3 - cosmwasm-vm 1.5.8, 2.0.7, 2.1.4 Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/edcdbc520d4f5521eed42de6e2869658278e91fd - 2.0: https://github.com/CosmWasm/cosmwasm/commit/f63429ca59eb44dd5d780c1572016581337091e4 - 2.1: https://github.com/CosmWasm/cosmwasm/commit/108e7dcbf9c21df0fa83f355ad3a7355d7f220cb Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: go list -m github.com/CosmWasm/wasmvm 2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you…
Recommended action: Upgrade to 2.1.3 or 2.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/CosmWasm/wasmvm/v2 >= 2.1.0, < 2.1.2; >= 2.0.0, < 2.0.3
Fixed in
2.0.32.1.2· Vendor fix available
Issue
Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. See CWA-2024-004 for more details.
Recommended action: Upgrade to 2.1.2 or 2.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.