Read the docs
TI-2021-17974 Aliases CVE-2021-41135GHSA-2p6r-37p9-89p2

Authz Module Non-Determinism

Priority LOW 32CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includes a user-defined expiration time for when the authorization grant expires. In Grant.ValidateBasic(), that time is compared to the node’s local clock time. Any chain running an affected version of the SDK with the authz module enabled could be halted by anyone with the ability to send transactions on that chain. Recovery would require applying the patch and rolling back the latest block. Users are advised to update to version 0.44.2.

Why it matters now

EPSS 0.01713 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cosmos-sdk (cosmos): 0.44.2github.com/cosmos/cosmos-sdk (Go): 0.44.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
cosmoscosmos-sdk0.43.0 to before 0.44.20.44.2Patch availableCNA
—github.com/cosmos/cosmos-sdk (Go)0.43.0 to before 0.44.20.44.2Patch availableGHSA-2p6r-37p9-89p2
  • cosmos-sdk Vendorcosmos Affected 0.43.0 to before 0.44.2 Fixed in 0.44.2 Patch available CNA
  • github.com/cosmos/cosmos-sdk (Go) Vendor— Affected 0.43.0 to before 0.44.2 Fixed in 0.44.2 Patch available GHSA-2p6r-37p9-89p2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:interchain:cosmos_sdk:*:*:*:*:*:*:*:*0.43.0 to before 0.44.2VulnerableInterchain
  • cpe:2.3:a:interchain:cosmos_sdk:*:*:*:*:*:*:*:* Versions 0.43.0 to before 0.44.2 Vulnerable ·Interchain

Remediation

  • Fix · CNA cosmos-sdk (cosmos) Fixed in 0.44.2
  • Fix · GHSA-2p6r-37p9-89p2 github.com/cosmos/cosmos-sdk (Go) Fixed in 0.44.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41135
  2. 2026-10-03 Alias added: GHSA-2p6r-37p9-89p2

References

Exploit 1

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences