GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production

• crates.io cosmwasm-vm: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • crates.io cosmwasm-vm: >= 2.1.0, < 2.1.6 → fixed in 2.1.6 • crates.io cosmwasm-vm: >= 2.0.0, < 2.0.9 → fixed in 2.0.9 • crates.io cosmwasm-vm: < 1.5.10 → fixed in 1.5.10 • Go github.com/CosmWasm/wasmvm: >= 0.1.0, < 1.5.8 → fixed in 1.5.8 • Go github.com/CosmWasm/wasmvm/v2: >= 2.2.0, < 2.2.2 → fixed in 2.2.2 • Go github.com/CosmWasm/wasmvm/v2: >= 2.1.0, < 2.1.5 → fixed in 2.1.5 • Go github.com/CosmWasm/wasmvm/v2: >= 2.0.0, < 2.0.6 → fixed in 2.0.6 • Go github.com/CosmWasm/wasmvm: < 0.0.0-20250204093451-1f4db20199b8 → fixed in 0.0.0-20250204093451-1f4db20199b8 • Go github.com/CosmWasm/wasmvm/v2: < 2.0.0-20250204103256-d62c3b826a9d → fixed in 2.0.0-20250204103256-d62c3b826a9d • Go github.com/CosmWasm/wasmvm: >= 1.5.8-0, < 1.5.8-0.20250204093451-1f4db20199b8 → fixed in 1.5.8-0.20250204093451-1f4db20199b8 • Go github.com/CosmWasm/wasmvm/v2: >= 2.0.6-0, < 2.0.6-0.20250204103256-d62c3b826a9d → fixed in 2.0.6-0.20250204103256-d62c3b826a9d

CWA-2025-002 Severity Medium (Moderate + Likely)[^1] Affected versions: • wasmvm >= 2.2.0, = 2.1.0, = 2.0.0, . Timeline • 2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet. • 2024-12-20: Confio security contributors confirm the report. • 2024-01-27: Confio developed the patch internally. • 2025-02-04: Patch gets released. [^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md