Use of a Cryptographic Primitive with a Risky Implementation Affecting github.com/cosmos/evm/x/vm/statedb package, versions >=0.3.0 <0.3.2>=0.4.0 <0.4.2>=0.5.0-rc.0 <0.5.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMCOSMOSEVMXVMSTATEDB-13653991
- published23 Oct 2025
- disclosed21 Oct 2025
- credityihuang
Introduced: 21 Oct 2025
New CVE NOT AVAILABLE CWE-1240 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/cosmos/evm/x/vm/statedb to version 0.3.2, 0.4.2, 0.5.0 or higher.
Overview
Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation in the handling of precompiles in the BalanceHandler that can cause prevEventsLen to be overwritten. An attacker can compromise the integrity or confidentiality of the system by exploiting improper processing of static or dynamic precompiles.
Note:
Maintainer's statement: "More information will be disclosed at a later point to ensure chains have time to safely upgrade."