Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/cosmos/cosmos-sdk < 0.50.14; >= 0.52.0-alpha.1, < 0.53.3
Fixed in
0.53.30.50.14· Vendor fix available
Issue
Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.50.13, <= 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK chains in unpatched releases that use the x/distribution module are affected. Description An issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state. Patches Has the problem been patched? What versions should users upgrade to? The new Cosmos SDK release v0.50.14 and v0.53.3 fix this issue. There are no known workarounds for this issue. It is advised that chains apply the update. This issue was reported to the Cosmos Bug Bounty Program by myte1111111 on HackerOne on April 15, 2025. If you…
Recommended action: Upgrade to 0.53.3 or 0.50.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0-alpha.0, <= 0.50.12; <= 0.47.16
Fixed in
0.47.170.50.13· Vendor fix available
Issue
Name: ISA-2025-002: x/group can halt when erroring in EndBlocker Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.47.16, <= 0.50.12 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Cosmos SDK chains in unpatched releases that use the x/group module are affected. Description An issue was discovered in the groups module where malicious proposals would result in an errors triggered in the module's end blocker that could result in a chain halt. Any set of users that can interact with the groups module could introduce this state. Patches Has the problem been patched? What versions should users upgrade to? The new Cosmos SDK release v0.50.13 and v0.47.17 fix this issue. Testing Testing we have done to gain more confidence in this release: In addition to testing Cosmos SDK we also did the following: - Ran a patched node in a local v0.50 testnet with the failing state and did not halt…
Recommended action: Upgrade to 0.50.13 or 0.47.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk <= 0.47.15; >= 0.50.0-alpha.0, <= 0.50.11
Fixed in
0.50.120.47.16-ics-lsm· Vendor fix available
Issue
Name: ASA-2025-003: Groups module can halt chain when handling a malicious proposal Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.47.15, <= 0.50.11 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Description An issue was discovered in the groups module where a malicious proposal would result in a division by zero, and subsequently halt a chain due to the resulting error. Any user that can interact with the groups module can introduce this state. Patches The new Cosmos SDK release v0.50.12 and v0.47.16 fix this issue. Workarounds There are no known workarounds for this issue. It is advised that chains apply the update. Timeline February 9, 2025, 5:18pm PST: Issue reported to the Cosmos Bug Bounty program February 9, 2025, 8:12am PST: Issue triaged by Amulet on-call, and distributed to Core team February 9, 2025, 12:25pm PST: Core team completes validation of issue February 18,…
Recommended action: Upgrade to 0.50.12 or 0.47.16-ics-lsm (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0-alpha.0, < 0.50.11; < 0.47.15
Fixed in
0.50.110.47.15· Vendor fix available
Issue
ASA-2024-0012 Name: ASA-2024-0012, Transaction decoding may result in a stack overflow Component: Cosmos SDK Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14 Affected users: Chain Builders + Maintainers, Validators, node operators ASA-2024-0013 Name: ASA-2024-0013: CosmosSDK: Transaction decoding may result in resource exhaustion Component: Cosmos SDK Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14 Affected users: Chain Builders + Maintainers, Validators, node operators Impact ASA-2024-0012 When decoding a maliciously formed packet with a deeply-nested structure, it may be possible for a stack overflow to occur and result in a network halt. This was addressed by adding a recursion limit while decoding the packet. ASA-2024-0013 Nested messages in a transaction can consume exponential cpu and…
Recommended action: Upgrade to 0.50.11 or 0.47.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0, <= 0.50.4
Fixed in
0.50.5· Vendor fix available
Issue
ASA-2024-006: ValidateVoteExtensions helper function may allow incorrect voting power assumptions Component: Cosmos SDK Criticality: High Affected Versions: Cosmos SDK versions <= 0.50.4, on 0.50 branches Affected Users: Chain developers, Validator and Node operators Impact: Elevation of Privilege Summary The default ValidateVoteExtensions helper function infers total voting power based off of the injected VoteExtension, which are injected by the proposer. If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each validator it includes in the injected VoteExtension, which could have potentially unexpected or negative consequences on modified state. Additional validation on injected VoteExtension data was added to confirm voting power against the state machine. Next Steps for Impacted Parties If you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest…
Recommended action: Upgrade to 0.50.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0, <= 0.50.4; <= 0.47.9
Fixed in
0.47.100.50.5· Vendor fix available
Issue
ASA-2024-005: Potential slashing evasion during re-delegation Component: Cosmos SDK Criticality: Low Affected Versions: Cosmos SDK versions <= 0.50.4; <= 0.47.9 Affected Users: Chain developers, Validator and Node operators Impact: Slashing Evasion Summary An issue was identified in the slashing mechanism that may allow for the evasion of slashing penalties during a slashing event. If a delegation contributed to byzantine behavior of a validator, and the validator has not yet been slashed, it may be possible for that delegation to evade a pending slashing penalty through re-delegation behavior. Additional validation logic was added to restrict this behavior. Next Steps for Impacted Parties If you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade. A Github Security Advisory for this issue is…
Recommended action: Upgrade to 0.50.5 or 0.47.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0, <= 0.50.3; <= 0.47.8
Fixed in
0.50.40.47.9· Vendor fix available
Issue
ASA-2024-002: Default PrepareProposalHandler may produce invalid proposals when used with default SenderNonceMempool Component: Cosmos SDK Criticality: Medium Affected Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8 Affected Users: Chain developers, Validator and Node operators Impact: Denial of Service Summary When using the default PrepareProposalHandler and the default SenderNonceMempool, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network. Next Steps for Impacted Parties If you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade. A Github Security Advisory for this issue is…
Recommended action: Upgrade to 0.50.4 or 0.47.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.50.0, <= 0.50.3; <= 0.47.8
Fixed in
0.50.40.47.9· Vendor fix available
Issue
ASA-2024-003: Missing BlockedAddressed Validation in Vesting Module Component: Cosmos SDK Criticality: Low Affected Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8 Affected Users: Chain developers, Validator and Node operators Impact: Denial of Service Description A vulnerability was identified in the x/auth/vesting module, which can allow a user to create a periodic vesting account on a blocked address, for example a non-initialized module account. Additional validation was added to prevent creation of a periodic vesting account in this scenario. If this case is triggered, there is the potential for a chain halt if the uninitialized account in question is called by GetModuleAccount in Begin/EndBlock of a module. This combination of an uninitialized blocked module account is not common. Next Steps for Impacted Parties If your chain has uninitialized blocked module accounts, it is recommended to proactively initialize them, as they are often initialized during a chain migration or…
Recommended action: Upgrade to 0.50.4 or 0.47.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.46.0, <= 0.46.12; >= 0.47.0, <= 0.47.2
Fixed in
0.46.130.47.3· Vendor fix available
Issue
Impact In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able to withdraw them. Patches \= v0.46.13 for Cosmos SDK v0.46.x \= v0.47.3 for Cosmos SDK v0.47.x If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too. Workarounds There is no workaround for this issue. Upgrade immediately. References Patched versions release notes: v0.47.3, v0.46.13. Forum Post
Recommended action: Upgrade to 0.47.3 or 0.46.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/cosmos/cosmos-sdk >= 0.43.0, < 0.44.2
Fixed in
0.44.2· Vendor fix available
Issue
Impact Consensus failure for 0.43.x and 0.44.{0,1} users. Funds and balances are safe. Patches 0.44.2 Workarounds Manually patch the code. --- Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Recommended action: Upgrade to 0.44.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.