Read the docs
TI-2023-30830 Aliases GHSA-w6rp-vxj2-fjhr

Cosmos packet-forward-middleware vulnerable to chain-halt

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The [packet-forward-middleware](https://github.com/cosmos/ibc-apps/tree/main/middleware/packet-forward-middleware) module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The `packet-forward-middleware` module is vulnerable to potential chain-halt due to error non-determinism. ### Patches Please patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version: v4.1.1 v5.2.1 v6.1.1

Why it matters now

Fix Fixed github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 (Go): 4.1.1github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 (Go): 5.2.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 (Go)before 4.1.14.1.1Patch availableGHSA-w6rp-vxj2-fjhr
—github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 (Go)before 5.2.15.2.1Patch availableGHSA-w6rp-vxj2-fjhr
—github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 (Go)before 6.1.16.1.1Patch availableGHSA-w6rp-vxj2-fjhr
  • github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 (Go) Vendor— Affected before 4.1.1 Fixed in 4.1.1 Patch available GHSA-w6rp-vxj2-fjhr
  • github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 (Go) Vendor— Affected before 5.2.1 Fixed in 5.2.1 Patch available GHSA-w6rp-vxj2-fjhr
  • github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 (Go) Vendor— Affected before 6.1.1 Fixed in 6.1.1 Patch available GHSA-w6rp-vxj2-fjhr

Remediation

  • Fix · GHSA-w6rp-vxj2-fjhr github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 (Go) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-w6rp-vxj2-fjhr github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 (Go) Fixed in 5.2.1 Advisory →
  • Fix · GHSA-w6rp-vxj2-fjhr github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 (Go) Fixed in 6.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-w6rp-vxj2-fjhr

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences