Read the docs
TI-2024-39016 Aliases GHSA-75qh-gg76-p2w4

CWA-2023-004: Excessive number of function parameters in compiled Wasm

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.

Summary

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see [CWA-2023-004](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md).

Why it matters now

Fix Fixed cosmwasm-vm (crates.io): 1.2.8, 1.3.4, 1.4.2 +1github.com/CosmWasm/wasmvm (Go): 1.2.5, 1.3.1, 1.4.2 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cosmwasm-vm (crates.io)before 1.2.81.2.8Patch availableGHSA-75qh-gg76-p2w4
—cosmwasm-vm (crates.io)1.3.0 to before 1.3.41.3.4Patch availableGHSA-75qh-gg76-p2w4
—cosmwasm-vm (crates.io)1.4.0 to before 1.4.21.4.2Patch availableGHSA-75qh-gg76-p2w4
—cosmwasm-vm (crates.io)1.5.0 to before 1.5.11.5.1Patch availableGHSA-75qh-gg76-p2w4
—github.com/CosmWasm/wasmvm (Go)before 1.2.51.2.5Patch availableGHSA-75qh-gg76-p2w4
—github.com/CosmWasm/wasmvm (Go)1.3.0 to before 1.3.11.3.1Patch availableGHSA-75qh-gg76-p2w4
—github.com/CosmWasm/wasmvm (Go)1.4.0 to before 1.4.21.4.2Patch availableGHSA-75qh-gg76-p2w4
—github.com/CosmWasm/wasmvm (Go)1.5.0 to before 1.5.11.5.1Patch availableGHSA-75qh-gg76-p2w4
  • cosmwasm-vm (crates.io) Vendor— Affected before 1.2.8 Fixed in 1.2.8 Patch available GHSA-75qh-gg76-p2w4
  • cosmwasm-vm (crates.io) Vendor— Affected 1.3.0 to before 1.3.4 Fixed in 1.3.4 Patch available GHSA-75qh-gg76-p2w4
  • cosmwasm-vm (crates.io) Vendor— Affected 1.4.0 to before 1.4.2 Fixed in 1.4.2 Patch available GHSA-75qh-gg76-p2w4
  • cosmwasm-vm (crates.io) Vendor— Affected 1.5.0 to before 1.5.1 Fixed in 1.5.1 Patch available GHSA-75qh-gg76-p2w4
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected before 1.2.5 Fixed in 1.2.5 Patch available GHSA-75qh-gg76-p2w4
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected 1.3.0 to before 1.3.1 Fixed in 1.3.1 Patch available GHSA-75qh-gg76-p2w4
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected 1.4.0 to before 1.4.2 Fixed in 1.4.2 Patch available GHSA-75qh-gg76-p2w4
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected 1.5.0 to before 1.5.1 Fixed in 1.5.1 Patch available GHSA-75qh-gg76-p2w4

Remediation

  • Fix · GHSA-75qh-gg76-p2w4 cosmwasm-vm (crates.io) Fixed in 1.2.8 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 cosmwasm-vm (crates.io) Fixed in 1.3.4 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 cosmwasm-vm (crates.io) Fixed in 1.4.2 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 cosmwasm-vm (crates.io) Fixed in 1.5.1 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 github.com/CosmWasm/wasmvm (Go) Fixed in 1.2.5 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 github.com/CosmWasm/wasmvm (Go) Fixed in 1.3.1 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 github.com/CosmWasm/wasmvm (Go) Fixed in 1.4.2 Advisory →
  • Fix · GHSA-75qh-gg76-p2w4 github.com/CosmWasm/wasmvm (Go) Fixed in 1.5.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-75qh-gg76-p2w4

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences