Every CVESearch/Get API key

GHSA-75qh-gg76-p2w4

CWA-2023-004: Excessive number of function parameters in compiled Wasm

6.9 MediumFix available

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see CWA-2023-004.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

What each source reports

GitHub Advisories Score used6.9

CWA-2023-004: Excessive number of function parameters in compiled Wasm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see CWA-2023-004.

Record
GHSA-75qh-gg76-p2w4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSV6.9

CWA-2023-004: Excessive number of function parameters in compiled Wasm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see CWA-2023-004.

Record
GHSA-75qh-gg76-p2w4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVGO-2024-3101No score

Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

Record
GO-2024-3101
Updated
2026-11-02
OSVRUSTSEC-2024-0366No score

CWA-2023-004: Excessive number of function parameters in compiled Wasm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see CWA-2023-004.

Record
RUSTSEC-2024-0366
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
cosmwasm-vm
crates.io
before 1.2.8
1.2.8
cosmwasm-vm
crates.io
1.3.0 up to 1.3.4
1.3.4
cosmwasm-vm
crates.io
1.4.0 up to 1.4.2
1.4.2
cosmwasm-vm
crates.io
1.5.0 up to 1.5.1
1.5.1
github.com/CosmWasm/wasmvm
Go
before 1.2.5
1.2.5
github.com/CosmWasm/wasmvm
Go
1.3.0 up to 1.3.1
1.3.1
github.com/CosmWasm/wasmvm
Go
1.4.0 up to 1.4.2
1.4.2
github.com/CosmWasm/wasmvm
Go
1.5.0 up to 1.5.1
1.5.1
github.com/CosmWasm/wasmvm
Go
before 1.2.5, 1.3.0 up to 1.3.1, 1.4.0 up to 1.4.2, 1.5.0 up to 1.5.1
1.2.51.3.11.4.21.5.1
cosmwasm-vm
crates.io
0.0.0-0 up to 1.2.8, 1.3.0 up to 1.3.4, 1.4.0 up to 1.4.2, 1.5.0 up to 1.5.1
1.2.81.3.41.4.21.5.1

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-75qh-gg76-p2w4 is a medium vulnerability (CVSS 6.9) in cosmwasm-vm, published August 27, 2024. No source lists public exploit code. Fixed in cosmwasm-vm 1.2.8.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open