Security Digest · Critical advisory (no CVE assigned)
GHSA-4wf3-5qj9-368v: IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt
Name: ISA-2025-001: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt Component: IBC-Go Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: IBC-Go >= v7; Earlier IBC-Go versions MAY also be affected.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/cosmos/ibc-go | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v8 | >= 8.0.0-alpha.1, < 8.7.0 | 8.7.0 |
| Go | github.com/cosmos/ibc-go/v2 | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v3 | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v4 | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v5 | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v6 | < 7.10.0 | 7.10.0 |
| Go | github.com/cosmos/ibc-go/v7 | < 7.10.0 | 7.10.0 |
Details
Name: ISA-2025-001: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt Component: IBC-Go Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: IBC-Go >= v7; Earlier IBC-Go versions MAY also be affected. Affected users: Validators, Full nodes, IBC Middleware authors
Description
An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain. The following patch is in addition to the previous patch which now extends the same protection to all applications beyond transfer.
Patches
The new IBC-Go releases below address this issue:
v7.10.0 v8.7.0
Workarounds
To prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround.
Sources and references
- GitHub Advisory GHSA-4wf3-5qj9-368v github.com
- github.com github.com
- github.com github.com
- github.com github.com