GHSA-23qp-3c2m-xx6w wasmvm: Malicious smart contract can crash the chain

• Go github.com/CosmWasm/wasmvm: < 1.5.8 → fixed in 1.5.8 • Go github.com/CosmWasm/wasmvm/v2: >= 2.0.0, < 2.0.6 → fixed in 2.0.6 • Go github.com/CosmWasm/wasmvm/v2: >= 2.1.0, < 2.1.5 → fixed in 2.1.5 • Go github.com/CosmWasm/wasmvm/v2: >= 2.2.0, < 2.2.2 → fixed in 2.2.2

CWA-2025-001 Severity Medium (Moderate + Likely)[^1] Affected versions: • wasmvm >= 2.2.0, = 2.1.0, = 2.0.0, . Timeline • 2024-11-25: Confio receives a report through the Cosmos bug bounty program maintained by Amulet. • 2024-11-28: Confio security contributors confirm the report. • 2024-11-28: Confio developed the patch internally. • 2025-02-04: Patch gets released. [^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md