HighCVSS 7.5
EPSS 0.55%
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
Vendor
CosmWasm vulnerabilities
14 published CVES affecting CosmWasm, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 14
- Critical
- 0
- High
- 3
- Medium
- 4
- Low
- 0
- Unscored
- 7
- CISA KEV
- 0
Products
- github.com/CosmWasm/wasmvm 6
- github.com/CosmWasm/wasmd 5
- cosmwasm 1
- cosmwasm-std 1
- serde-json-wasm 1
Latest CosmWasm CVEs
Newest publication first
-
-
MediumCVSS 5.3 EPSS 0.50%
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
-
Unknown
CWA-2025-006: Improper error handling may lead to IBC channel opening despite error Severity High (Considerable + Likely)[^1] Affected versions: wasmd 0.60.0 wasmd >= 0.51.0 < 0.55.1 Patched versions: wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3 Description of the bug A contract erroring...
-
HighCVSS 7.5 EPSS 0.80%
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockch...
-
Unknown
CWA-2025-002 Severity Medium (Moderate + Likely)[^1] Affected versions: wasmvm >= 2.2.0, < 2.2.2 wasmvm >= 2.1.0, < 2.1.5 wasmvm >= 2.0.0, < 2.0.6 wasmvm < 1.5.8 Patched versions: wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 Description of the bug The vulnerability can be used to slow down...
-
Unknown
CWA-2025-001 Severity Medium (Moderate + Likely)[^1] Affected versions: wasmvm >= 2.2.0, < 2.2.2 wasmvm >= 2.1.0, < 2.1.5 wasmvm >= 2.0.0, < 2.0.6 wasmvm < 1.5.8 Patched versions: wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 Description of the bug The vulnerability can be used to crash the...
-
Unknown
CWA-2024-007 Severity Medium (Moderate + Likely)[^1] Affected versions: wasmvm >= 2.1.0, < 2.1.3 wasmvm >= 2.0.0, < 2.0.4 wasmvm < 1.5.5 cosmwasm-vm >= 2.1.0, < 2.1.4 cosmwasm-vm >= 2.0.0, < 2.0.7 cosmwasm-vm < 1.5.8 Patched versions: wasmvm 1.5.5, 2.0.4, 2.1.3 cosmwasm-vm 1.5.8,...
-
Unknown
CWA-2024-008 Severity Medium (Moderate + Likely)[^1] Affected versions: wasmvm >= 2.1.0, < 2.1.3 wasmvm >= 2.0.0, < 2.0.4 wasmvm < 1.5.5 cosmwasm-vm >= 2.1.0, < 2.1.4 cosmwasm-vm >= 2.0.0, < 2.0.7 cosmwasm-vm < 1.5.8 Patched versions: wasmvm 1.5.5, 2.0.4, 2.1.3 cosmwasm-vm 1.5.8,...
-
Unknown
CWA-2024-009 Severity Low (Marginal + Likely)[^1] Affected versions: wasmd < 0.53.1 Patched versions: wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used) Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Mit...
-
GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm
PublishedMediumCVSS 6.9A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more info...
-
Unknown
Component: wasmd Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmd 0.53.0 See CWA-2024-006 for more details.
-
HighCVSS 8.7
Component: wasmd Criticality: High (ACMv1: I:Critical; L:Likely) Patched versions: wasmd 0.53.0, 0.46.0 See CWA-2024-005 for more details.
-
MediumCVSS 6.3
Component: wasmd Criticality: Low (ACMv1: I:Moderate; L:Unlikely) Patched versions: wasmd 0.52.0 In multiple wasmd message types it was possible to add a large number of addresses which might lead to unexpected resource consumption in ValidateBasic. See CWA-2024-003 for more deta...
-
MediumCVSS 5.3
Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a ma...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.