Vulnerability MediumRUSTSEC-2024-0361 · cosmwasm-vm
RUSTSEC-2024-0361: CWA-2024-004: Gas mispricing in cosmwasm-vm
Short answerA security vulnerability in the cosmwasm-vm crate: CWA-2024-004: Gas mispricing in cosmwasm-vm. GitHub rates it Medium. Fixed in 1.5.7, 2.0.6, 2.1.3: update to a fixed version.
| Crate | cosmwasm-vm |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 1.5.7; from 2.0.0 before 2.0.6; from 2.1.0 before 2.1.3. |
| Fixed in | 1.5.7, 2.0.6, 2.1.3 |
| Severity | Medium (GitHub rating) |
| Published | 2024-08-08 |
| Last changed | 2024-08-08 |
| Also known as | GHSA-rg2q-2jh9-447q |
What to do
- See which version you have:
cargo tree -i cosmwasm-vm(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p cosmwasm-vm. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplecosmwasm-vm = "2.1.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.
For more information, see CWA-2024-004.
References
- Package: crates.io/crates/cosmwasm-vm
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0361.html
- Advisory: github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for cosmwasm-vm
- VulnerabilityRUSTSEC-2024-0366 · 2024-08-27CWA-2023-004: Excessive number of function parameters in compiled Wasm
- VulnerabilityGHSA-2q97-m5rc-p3gp · 2024-12-10CosmWasm VM Incorrect metering
- VulnerabilityGHSA-2q97-m5rc-p3gp · 2024-12-10CosmWasm VM Incorrect metering
- VulnerabilityGHSA-2q97-m5rc-p3gp · 2024-12-10CosmWasm VM Incorrect metering
- VulnerabilityGHSA-mx2j-7cmv-353c · 2025-02-04wasmvm: Malicious smart contract can slow down block production
- VulnerabilityGHSA-mx2j-7cmv-353c · 2025-02-04wasmvm: Malicious smart contract can slow down block production
- VulnerabilityGHSA-mx2j-7cmv-353c · 2025-02-04wasmvm: Malicious smart contract can slow down block production
- VulnerabilityGHSA-mx2j-7cmv-353c · 2025-02-04wasmvm: Malicious smart contract can slow down block production
Up next
Same cratecosmwasm-vm: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?