PT-2025-9199 · Ibc-Go · Ibc-Go

Published 2025-02-28 · Updated 2025-02-28

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions IBC-Go versions 7 and later

Description An issue was discovered in IBC-Go's deserialization of acknowledgements, resulting in non-deterministic behavior that can halt a chain. Any user who can open an IBC channel can introduce this state to the chain.

Recommendations For IBC-Go versions 7 and later, update to version 7.9.2 or 8.6.1 to address this issue. As a temporary workaround, consider permissioning Channel Opening to prevent this state from being introduced to a chain. If you depend on middlewares that serialize acknowledgement packets, update them to use ibc-go's codec: transfertypes.ModuleCdc.[Must]MarshalJSON to avoid failing transfers or a chain halt. For absolute clarity, chains with these ack-serializing middlewares must do coordinated upgrades.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-JG6F-48FF-5XRW

Affected Products

Ibc-Go

References · 5

• https://osv.dev/vulnerability/GHSA-jg6f-48ff-5xrw · Vendor Advisory
• https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw · Note
• https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748 · Note
• https://github.com/cosmos/ibc-go · Note
• https://github.com/cosmos/ibc-go/commit/9869b3c6f7eb05a935b1eb33611c5406f68438a5 · Note