Light client verification not taking into account chain ID
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| informalsystems | tendermint-rs | 0.28.0 | — | No fix listed | CNA |
| — | tendermint-light-client-verifier (crates.io) | before 0.28.0 | 0.28.0 | Patch available | GHSA-xqqc-c5gw-c5r5 |
| — | tendermint-light-client (crates.io) | before 0.28.0 | 0.28.0 | Patch available | GHSA-xqqc-c5gw-c5r5 |
| — | tendermint-light-client-js (crates.io) | before 0.28.0 | 0.28.0 | Patch available | GHSA-xqqc-c5gw-c5r5 |
- tendermint-rs Vendorinformalsystems Affected 0.28.0 Fixed in — No fix listed CNA
- tendermint-light-client-verifier (crates.io) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-xqqc-c5gw-c5r5
- tendermint-light-client (crates.io) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-xqqc-c5gw-c5r5
- tendermint-light-client-js (crates.io) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-xqqc-c5gw-c5r5
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tendermint-light-client-js_project:tendermint-light-client-js:*:*:*:*:rust:*:*:* | before 0.28.0 | Vulnerable | Tendermint-light-client-js Project |
| cpe:2.3:a:tendermint-light-client-verifier_project:tendermint-light-client-verifier:*:*:*:*:*:rust:*:* | before 0.28.0 | Vulnerable | Tendermint-light-client-verifier Project |
| cpe:2.3:a:tendermint-light-client_project:tendermint-light-client:*:*:*:*:rust:*:*:* | before 0.28.0 | Vulnerable | Tendermint-light-client Project |
- cpe:2.3:a:tendermint-light-client-js_project:tendermint-light-client-js:*:*:*:*:rust:*:*:* Versions before 0.28.0 Vulnerable ·Tendermint-light-client-js Project
- cpe:2.3:a:tendermint-light-client-verifier_project:tendermint-light-client-verifier:*:*:*:*:*:rust:*:* Versions before 0.28.0 Vulnerable ·Tendermint-light-client-verifier Project
- cpe:2.3:a:tendermint-light-client_project:tendermint-light-client:*:*:*:*:rust:*:*:* Versions before 0.28.0 Vulnerable ·Tendermint-light-client Project
Remediation
- Fix · GHSA-xqqc-c5gw-c5r5 tendermint-light-client-verifier (crates.io) Fixed in 0.28.0 Advisory →
- Fix · GHSA-xqqc-c5gw-c5r5 tendermint-light-client (crates.io) Fixed in 0.28.0 Advisory →
- Fix · GHSA-xqqc-c5gw-c5r5 tendermint-light-client-js (crates.io) Fixed in 0.28.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23507
- 2026-10-03 Alias added: GHSA-xqqc-c5gw-c5r5
References
Sources
- CVE-2022-23507 · CVE Program
- CVE-2022-23507 · NVD
- FIRST EPSS
- GHSA-xqqc-c5gw-c5r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences