GitHub Advisoryadvisory · Go
GHSA-6fgm-x6ff-w78f Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain
MEDIUM
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Reviewed
- 2025-02-12
Affected packages
• Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7: < 7.2.1 → fixed in 7.2.1
• Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8: < 8.1.1 → fixed in 8.1.1
• Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4: < 7.2.1 (no fix yet)
• Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5: < 7.2.1 (no fix yet)
• Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6: < 7.2.1 (no fix yet)
Description
Impact
Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.
We recommend upgrading as soon as possible.
__THIS IS A STATE BREAKING CHANGE__
Patches
Versions 7.2.1 and 8.1.1 are patched.
Workarounds
N/A
References
N/A
References
- https://github.com/cosmos/ibc-apps/security/advisories/GHSA-6fgm-x6ff-w78f web
- https://github.com/cosmos/ibc-apps package
- https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv7.2.1 web
- https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv8.1.1 web