—

RUSTSEC-2024-0366

CWA-2023-004: Excessive number of function parameters in compiled Wasm

Details

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see [CWA-2023-004](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/cosmwasm-vm

Introduced in: 0.0.0-0Fixed in: 1.2.8

Upgrade cosmwasm-vm to 1.2.8 or newer (ecosystem crates.io).

References

https://crates.io/crates/cosmwasm-vm[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2024-0366.html[ADVISORY]
https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md[ADVISORY]