PT-2025-5698 · Wasmvm · Wasmvm
Published
2025-02-04
·
Updated
2025-02-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
wasmvm versions 2.2.0 through 2.2.1
wasmvm versions 2.1.0 through 2.1.4
wasmvm versions 2.0.0 through 2.0.5
wasmvm versions prior to 1.5.8
Description:
The issue can be used to crash the chain and is present on both permissioned and permissionless chains. However, it can only be triggered reliably with a malicious contract, making permissioned chains less likely to be affected.
Recommendations:
For versions 2.2.0 through 2.2.1, update to version 2.2.2.
For versions 2.1.0 through 2.1.4, update to version 2.1.5.
For versions 2.0.0 through 2.0.5, update to version 2.0.6.
For versions prior to 1.5.8, update to version 1.5.8.
To apply the patch, check the current wasmvm version, bump the dependency in your go.mod to one of the patched versions, run
go mod tidy, and commit the changes. If using static libraries, update them accordingly and verify the updated wasmvm version. Follow regular practices to deploy chain upgrades.NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wasmvm