anchor-token (>=0.0.1, <=0.3.0), astro4nit (0.0.1) +60 more potentially affected by unknown CVE via cw0 (>=0.2.3, <=0.10.3)

cw0 CARGO version =0.2.3, =0.0.1, =0.3.1, =2.5.2, =0.1.0, =0.3.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.6.0-beta1, =0.6.0-beta1, =0.2.0, =0.2.1, =0.10.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0385...

Stack-based Buffer Overflow

github.com/cosmwasm/wasmd is vulnerable to Stack-based Buffer Overflow. The vulnerability is due to improper memory handling, which can lead to stack overflow conditions.This can potentially crash the program or allow attackers to execute arbitrary code...

GO-2024-3059 CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd

CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd...

Uncontrolled Resource Consumption

github.com/CosmWasm/wasmd is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the ability to add a large number of addresses in multiple message types, which may lead to unexpected resource consumption in ValidateBasic...

CosmWasm wasmd has large address count in ValidateBasic

Component: wasmd Criticality: Low ACMv1: I:Moderate; L:Unlikely Patched versions: wasmd 0.52.0 In multiple wasmd message types it was possible to add a large number of addresses which might lead to unexpected resource consumption in ValidateBasic. See CWA-2024-003 for more details...

GHSA-M3RH-CVR5-X6Q4 CosmWasm wasmd has large address count in ValidateBasic

Component: wasmd Criticality: Low ACMv1: I:Moderate; L:Unlikely Patched versions: wasmd 0.52.0 In multiple wasmd message types it was possible to add a large number of addresses which might lead to unexpected resource consumption in ValidateBasic. See CWA-2024-003 for more details...

cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)

cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RG2Q-2JH9-447Q...

CWA-2024-004: Gas mispricing in cosmwasm-vm

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. For more...

cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)

cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0361...

RUSTSEC-2024-0361 CWA-2024-004: Gas mispricing in cosmwasm-vm

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. For more...

CosmWasm wasmd has large address count in ValidateBasic

Component: wasmd Criticality: Low ACMv1: I:Moderate; L:Unlikely Patched versions: wasmd 0.52.0 In multiple wasmd message types it was possible to add a large number of addresses which might lead to unexpected resource consumption in ValidateBasic. See CWA-2024-003 for more details...

Gas mispricing in cosmwasm-vm

Component: wasmvm Criticality: Medium ACMv1: I:Moderate; L:Likely Patched versions: wasmvm 1.5.3, 2.0.2, 2.1.1...

Gas mispricing in cosmwasm-vm

Component: wasmvm Criticality: Medium ACMv1: I:Moderate; L:Likely Patched versions: wasmvm 1.5.3, 2.0.2, 2.1.1...

CosmWasm affected by arithmetic overflows

Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: - Uint256,512::pow / Int256,512::pow - Int256,512::neg Affected if overflow-checks ...

abstract-account-factory (>=0.13.0, <=0.16.1), abstract-adapter-utils (>=0.16.0, <=0.19.2) +416 more potentially affected by CVE-2024-58263 via cosmwasm-std (1.3.4)

cosmwasm-std CARGO version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cosmwasm-std and may be impacted: - abstract-account-factory =0.13.0, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.13.0, =0.16.5,...

GHSA-8724-5XMM-W5XQ CosmWasm affected by arithmetic overflows

Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: - Uint256,512::pow / Int256,512::pow - Int256,512::neg Affected if overflow-checks ...

abstract-account-factory (>=0.13.0, <=0.16.1), abstract-adapter-utils (>=0.16.0, <=0.19.2) +416 more potentially affected by CVE-2024-58263 via cosmwasm-std (1.3.4)

cosmwasm-std CARGO version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cosmwasm-std and may be impacted: - abstract-account-factory =0.13.0, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.13.0, =0.16.5,...

RUSTSEC-2024-0338 Arithmetic overflows in cosmwasm-std

Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: - Uint256,512::pow / Int256,512::pow - Int256,512::neg Affected if overflow-checks ...

Arithmetic overflows in cosmwasm-std

Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: - Uint256,512::pow / Int256,512::pow - Int256,512::neg Affected if overflow-checks ...

PT-2025-31019 · Unknown · Cosmwasm-Std

Name of the Vulnerable Software and Affected Versions: cosmwasm-std crate versions prior to 2.0.2 Description: The cosmwasm-std crate contains an integer overflow issue that can lead to incorrect contract calculations. Recommendations: Update to version 2.0.2 or later...