{"id":"GHSA-mx2j-7cmv-353c","aliases":["GO-2025-3449"],"status":"published","title":"wasmvm: Malicious smart contract can slow down block production","description":"# CWA-2025-002\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.2.0, \u003c 2.2.2\n- wasmvm \u003e= 2.1.0, \u003c 2.1.5\n- wasmvm \u003e= 2.0.0, \u003c 2.0.6\n- wasmvm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2\n\n## Description of the bug\n\nThe vulnerability can be used to slow down block production. The attack requires a malicious contract,\nso permissioned chains are unlikely to be affected.\n\n(We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58\n- 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to one of the patched version\n   depending on which minor version you are on; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2.\n5. Follow your regular practices to deploy chain upgrades.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-12-20: Confio security contributors confirm the report.\n- 2024-01-27: Confio developed the patch internally.\n- 2025-02-04: Patch gets released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-02-04T18:57:21Z","modified":"2026-03-03T04:57:12Z","fixes":[{"ecosystem":"crates.io","package":"cosmwasm-vm","fixed_in":["2.2.1","2.1.6","2.0.9","1.5.10"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","fixed_in":["2.2.2","2.1.5","2.0.0-20250204103256-d62c3b826a9d","2.0.6","2.0.6-0.20250204103256-d62c3b826a9d"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","fixed_in":["0.0.0-20250204093451-1f4db20199b8","1.5.8","1.5.8-0.20250204093451-1f4db20199b8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.6"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20250204093451-1f4db20199b8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-20250204103256-d62c3b826a9d"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"1.5.7"},{"fixed":"1.5.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.5"},{"fixed":"2.0.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.8-0"},{"fixed":"1.5.8-0.20250204093451-1f4db20199b8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.6-0"},{"fixed":"2.0.6-0.20250204103256-d62c3b826a9d"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"1.5.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250204093451-1f4db20199b8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0-20250204103256-d62c3b826a9d"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.8-0"},{"fixed":"1.5.8-0.20250204093451-1f4db20199b8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.6-0"},{"fixed":"2.0.6-0.20250204103256-d62c3b826a9d"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"},{"introduced":"2.1.0"},{"fixed":"2.1.5"},{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}]}],"references":[{"url":"https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-mx2j-7cmv-353c","tags":["web","advisory"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58","tags":["web"]},{"url":"https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-002.md","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3449","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mx2j-7cmv-353c"},{"url":"https://github.com/CosmWasm/wasmvm","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mx2j-7cmv-353c","title":"wasmvm: Malicious smart contract can slow down block production","description":"# CWA-2025-002\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.2.0, \u003c 2.2.2\n- wasmvm \u003e= 2.1.0, \u003c 2.1.5\n- wasmvm \u003e= 2.0.0, \u003c 2.0.6\n- wasmvm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2\n\n## Description of the bug\n\nThe vulnerability can be used to slow down block production. The attack requires a malicious contract,\nso permissioned chains are unlikely to be affected.\n\n(We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58\n- 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to one of the patched version\n   depending on which minor version you are on; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2.\n5. Follow your regular practices to deploy chain upgrades.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-12-20: Confio security contributors confirm the report.\n- 2024-01-27: Confio developed the patch internally.\n- 2025-02-04: Patch gets released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md","status":"published","published":"2025-02-04T18:57:21Z","modified":"2025-07-09T16:06:11Z","updated_at":"2026-11-02T14:38:49.837727Z"}],"osv":[{"id":"GHSA-mx2j-7cmv-353c","title":"wasmvm: Malicious smart contract can slow down block production","description":"# CWA-2025-002\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.2.0, \u003c 2.2.2\n- wasmvm \u003e= 2.1.0, \u003c 2.1.5\n- wasmvm \u003e= 2.0.0, \u003c 2.0.6\n- wasmvm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2\n\n## Description of the bug\n\nThe vulnerability can be used to slow down block production. The attack requires a malicious contract,\nso permissioned chains are unlikely to be affected.\n\n(We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58\n- 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to one of the patched version\n   depending on which minor version you are on; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2.\n5. Follow your regular practices to deploy chain upgrades.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-12-20: Confio security contributors confirm the report.\n- 2024-01-27: Confio developed the patch internally.\n- 2025-02-04: Patch gets released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md","status":"published","published":"2025-02-04T18:57:21Z","modified":"2025-07-09T16:06:08Z","updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GO-2025-3449","title":"wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm","description":"wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm","status":"published","published":"2025-02-05T23:27:45Z","modified":"2026-03-03T04:57:12.054563Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}