---
title: "GHSA-jg6f-48ff-5xrw: IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement"
url: https://erroneo.us/security/ghsa/GHSA-jg6f-48ff-5xrw/
description: "GHSA-jg6f-48ff-5xrw (critical, Go): IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement. Name: ASA-2025-004: Non-deterministic JSON…"
type: advisory
section: "Security Digest"
date_published: 2025-02-28
date_modified: 2025-02-28
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-jg6f-48ff-5xrw"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-jg6f-48ff-5xrw: IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement

## Affected packages

- Go `github.com/cosmos/ibc-go` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v2` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v3` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v4` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v5` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v6` < 7.9.2 → fixed: none listed
- Go `github.com/cosmos/ibc-go/v7` < 7.9.2 → fixed: 7.9.2
- Go `github.com/cosmos/ibc-go/v8` < 8.6.1 → fixed: 8.6.1

## Details

Name: ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt Component: IBC-Go Criticality: Critical (Considerable Impact; Almost Certain Likelihood per ACMv1.2) Affected versions: IBC-Go >= v7; Earlier IBC-Go versions may also be affected. Affected users: Validators, Full nodes, IBC Middleware authors Description An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain Patches The new IBC-Go releases below address this issue: v7.9.2 v8.6.1 Workarounds To prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround. Notes on Re-Release Is this state breaking? Probably not but it depends on your transfer middlewares This patch is not state breaking unless you depend on transfer middlewares that deserialize and serialize acknowledgement packets before passing them to the transfer handler. As far as we can tell, these middlewares are rare. For example, packet-forward-middleware and ibc-hooks, do not serialize ack packets in this way and therefore aren't broken by this patch. So if these are the only transfer middlewares you depend on, you can safely apply this patch in a rolling manner (and we've already cut new versions of these for you). What to do if you do depend on ack-serializing middleware In the unlikely case that you depend on middlewares that serialize ack packets and you do not update them when you apply this patch, all transfers that are handled by the middleware will fail (or experience other unexpected behavior) if the serialization approach differs from the transfer app's. If you have such dependencies and do not update them, validators who apply the patch in a rolling manner will halt when they upgrade, and transfers processed by the middleware will just fail once everyone has upgraded. To update these middlewares and avoid failing transfers or a chain halt, you will simply need to change the serialization approach in the middleware to use ibc-go's…

## Sources

- [GitHub Advisory GHSA-jg6f-48ff-5xrw](https://github.com/advisories/GHSA-jg6f-48ff-5xrw)
- [github.com](https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw)
- [github.com](https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748)
- [github.com](https://github.com/cosmos/ibc-go/commit/9869b3c6f7eb05a935b1eb33611c5406f68438a5)

---
Source page: https://erroneo.us/security/ghsa/GHSA-jg6f-48ff-5xrw/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt