Rust advisories / cosmwasm-std
Vulnerability LowRUSTSEC-2024-0338 · cosmwasm-std
RUSTSEC-2024-0338: Arithmetic overflows in cosmwasm-std
Short answerA security vulnerability in the cosmwasm-std crate: Arithmetic overflows in cosmwasm-std. GitHub rates it Low. Fixed in 1.4.4, 1.5.4, 2.0.2: update to a fixed version.
| Crate | cosmwasm-std |
|---|---|
| Type | Vulnerability |
| Affected versions | From 1.3.0 before 1.4.4; from 1.5.0 before 1.5.4; from 2.0.0 before 2.0.2. |
| Fixed in | 1.4.4, 1.5.4, 2.0.2 |
| Severity | Low (GitHub rating) |
| Published | 2024-04-24 |
| Last changed | 2025-10-28 |
| Also known as | CVE-2024-58263, GHSA-8724-5xmm-w5xq |
What to do
- See which version you have:
cargo tree -i cosmwasm-std(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p cosmwasm-std. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplecosmwasm-std = "2.0.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations.
Affected functions:
Uint{256,512}::pow/Int{256,512}::powInt{256,512}::neg
Affected if overflow-checks = true is not set:
Uint{64,128}::pow/Int{64,128}::powInt{64,128}::neg
References
- Package: crates.io/crates/cosmwasm-std
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0338.html
- Advisory: github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-002.md
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?