PT-2025-5642 · Wasmvm · Wasmvm

Published 2025-02-04 · Updated 2025-02-04

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: wasmvm versions 2.2.0 through 2.2.1 wasmvm versions 2.1.0 through 2.1.4 wasmvm versions 2.0.0 through 2.0.5 wasmvm versions prior to 1.5.8

Description: The issue can be used to slow down block production and requires a malicious contract. Permissioned chains are unlikely to be affected.

Recommendations: For versions 2.2.0 through 2.2.1, update to version 2.2.2. For versions 2.1.0 through 2.1.4, update to version 2.1.5. For versions 2.0.0 through 2.0.5, update to version 2.0.6. For versions prior to 1.5.8, update to version 1.5.8. As a temporary workaround, consider restricting the deployment of malicious contracts until a patch is applied. Follow your regular practices to deploy chain upgrades, noting that the patch is consensus breaking and requires a coordinated upgrade.

Related Identifiers

GHSA-MX2J-7CMV-353C

Affected Products

Wasmvm

References · 9

• https://osv.dev/vulnerability/GHSA-mx2j-7cmv-353c · Vendor Advisory
• https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b · Note
• https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0 · Note
• https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27 · Note
• https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58 · Note
• https://github.com/CosmWasm/wasmvm · Note
• https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-mx2j-7cmv-353c · Note
• https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-002.md · Note
• https://pkg.go.dev/vuln/GO-2025-3449 · Note