GHSA-6fgm-x6ff-w78f

Source

https://github.com/advisories/GHSA-6fgm-x6ff-w78f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6fgm-x6ff-w78f/GHSA-6fgm-x6ff-w78f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6fgm-x6ff-w78f

Aliases

GO-2025-3463

Published

2025-02-12T22:01:24Z

Modified

2025-03-11T17:14:26Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain

Details

Impact

Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.

We recommend upgrading as soon as possible.

THIS IS A STATE BREAKING CHANGE

Patches

Versions 7.2.1 and 8.1.1 are patched.

Workarounds

N/A

References

N/A

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-12T22:01:24Z"
}

References

Affected packages

Go / github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7

Package

Name: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.2.1

Go / github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8

Package

Name: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.1.1

Go / github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4

Package

Name: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Database specific

{
    "last_known_affected_version_range": "< 7.2.1"
}

Go / github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5

Package

Name: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Database specific

{
    "last_known_affected_version_range": "< 7.2.1"
}

Go / github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6

Package

Name: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Database specific

{
    "last_known_affected_version_range": "< 7.2.1"
}