What is GHSA-m3rh-cvr5-x6q4?

GHSA-m3rh-cvr5-x6q4 is a security advisory published by GitHub Security Advisories with Medium severity. CosmWasm wasmd has large address count in ValidateBasic

Why does GHSA-m3rh-cvr5-x6q4 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-m3rh-cvr5-x6q4?

GHSA-m3rh-cvr5-x6q4 has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-m3rh-cvr5-x6q4?

GHSA-m3rh-cvr5-x6q4 affects 1 product, including: go/github.com/CosmWasm/wasmd:\u003c 0.52.0.

GHSA-m3rh-cvr5-x6q4MediumCVSS 3.7Disclosed before NVD

CosmWasm wasmd has large address count in ValidateBasic

Vendor

GitHub Security Advisories

Published

August 8, 2024

Last Modified

July 6, 2026

📋 Description

Component: wasmd Criticality: Low (ACMv1: I:Moderate; L:Unlikely) Patched versions: wasmd 0.52.0

In multiple wasmd message types it was possible to add a large number of addresses which might lead to unexpected resource consumption in ValidateBasic.

See CWA-2024-003 for more details.

🎯 Affected products1

go/github.com/CosmWasm/wasmd:< 0.52.0

🔗 References (4)

https://github.com/CosmWasm/wasmd/security/advisories/GHSA-m3rh-cvr5-x6q4
https://github.com/CosmWasm/wasmd/commit/76c0c061c9cb6b142163883e46c26d99384dc443
https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-003.md
https://github.com/advisories/GHSA-m3rh-cvr5-x6q4