CVE-2025-61595

HighCVSS 8.8/10Last modified Oct 12, 2026

Description

MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-615975.4Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting CVE-2025-615985.3Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-s CVE-2025-615995.4Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG P CVE-2025-61609.8A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affect CVE-2025-616007.5Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP prot CVE-2025-616017.5BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authentica CVE-2025-616027.5BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authentica CVE-2025-616039.8WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in CVE-2025-616047.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilit CVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilit CVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition