Every CVESearch/Get API key

GHSA-rg2q-2jh9-447q

Gas mispricing in cosmwasm-vm

5.3 MediumFix available

GHSA-rg2q-2jh9-447q is a medium vulnerability (CVSS 5.3) in cosmwasm-vm, published August 8, 2024. No source lists public exploit code. Fixed in cosmwasm-vm 1.5.6.

What does this mean?
Severity
5.3 MediumCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.5.6cosmwasm-vm +6 more

Description

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

See CWA-2024-004 for more details.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Affected packages

Affected packages
PackageAffectedFixed
cosmwasm-vm
crates.io
before 1.5.6
1.5.6
cosmwasm-vm
crates.io
2.0.0 up to 2.0.5
2.0.5
cosmwasm-vm
crates.io
2.1.0 up to 2.1.2
2.1.2
github.com/CosmWasm/wasmvm/v2
Go
2.1.0 up to 2.1.2
2.1.2
github.com/CosmWasm/wasmvm/v2
Go
2.0.0 up to 2.0.3
2.0.3
github.com/CosmWasm/wasmvm
Go
before 1.5.4
1.5.4
cosmwasm-vm
crates.io
0.0.0-0 up to 1.5.7, 2.0.0 up to 2.0.6, 2.1.0 up to 2.1.3
1.5.72.0.62.1.3

What each source reports

GitHub Advisories Score used5.3

Gas mispricing in cosmwasm-vm

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

See CWA-2024-004 for more details.

Record
GHSA-rg2q-2jh9-447q
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-920
Updated
2026-11-02
OSV5.3

Gas mispricing in cosmwasm-vm

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

See CWA-2024-004 for more details.

Record
GHSA-rg2q-2jh9-447q
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-920
Updated
2026-11-02
OSVRUSTSEC-2024-0361No score

CWA-2024-004: Gas mispricing in cosmwasm-vm

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

For more information, see CWA-2024-004.

Record
RUSTSEC-2024-0361
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open