5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-75qh-gg76-p2w4

GHSA-75qh-gg76-p2w4: CWA-2023-004: Excessive number of function parameters in compiled Wasm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.

For more information, see CWA-2023-004.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-75qh-gg76-p2w4

GHSA-75qh-gg76-p2w4:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cosmwasm-vm	rust	< 1.2.8	1.2.8
cosmwasm-vm	rust	>= 1.3.0, < 1.3.4	1.3.4
cosmwasm-vm	rust	>= 1.4.0, < 1.4.2	1.4.2
cosmwasm-vm	rust	>= 1.5.0, < 1.5.1	1.5.1
github.com/CosmWasm/wasmvm	go	< 1.2.5	1.2.5
github.com/CosmWasm/wasmvm	go	>= 1.3.0, < 1.3.1	1.3.1
github.com/CosmWasm/wasmvm	go	>= 1.4.0, < 1.4.2	1.4.2
github.com/CosmWasm/wasmvm	go	>= 1.5.0, < 1.5.1	1.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability manifests during Wasm contract compilation where function signatures with excessive parameters are inlined. Key indicators from advisory materials:

The core issue is in signature handling during compilation (CWA-2023-004.md)
Problem occurs in 'modules of several hundreds of megabytes' after compilation
Fix involves adding parameter count validation in compilation process

While the provided commit only shows a dependency update, the described vulnerability pattern points to functions responsible for:

Wasm module compilation
Function signature processing
Memory allocation during code generation

The 'compile' and 'validate_wasm' functions are prime candidates as they would handle the vulnerable code paths described. Confidence is medium due to lack of direct patch evidence, but supported by the vulnerability description and affected component analysis.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.