GHSA-p22h-3m2v-cmgh: Github.com/cosmos/cosmos sdk Cosmos SDK's Integer Overflow Vulnerability Vulnerability
HIGHGHSA-p22h-3m2v-cmgh is a HIGH cosmos sdk's integer overflow vulnerability vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Github.com/cosmos/cosmos sdk libraries in the Go ecosystem. The issue involves cosmos sdk's integer overflow vulnerability in its validator rewards pool can cause a chain halt. Remediation is available by upgrading affected packages to version 0.50.14, 0.53.3.
GHSA-p22h-3m2v-cmgh at a Glance
How to Fix GHSA-p22h-3m2v-cmgh
To remediate this vulnerability, upgrade all affected Github.com/cosmos/cosmos sdk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/cosmos/cosmos-sdk to 0.50.14Upgrade github.com/cosmos/cosmos-sdk to 0.53.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/cosmos/cosmos-sdkHow to Check if You Are Affected
To determine whether your application is affected by GHSA-p22h-3m2v-cmgh, inspect your project dependencies for Github.com/cosmos/cosmos sdk:
inspect dependencies for github.com/cosmos/cosmos-sdkAnalyze the terminal output to locate any version of Github.com/cosmos/cosmos sdk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.50.14), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Github.com/cosmos/cosmos sdk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-p22h-3m2v-cmgh Affected Github.com/cosmos/cosmos sdk Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/cosmos/cosmos-sdk
|
Go |
< 0.50.14
|
0.50.14
|
|
github.com/cosmos/cosmos-sdk
|
Go |
≥ 0.52.0-alpha.1
< 0.53.3
|
0.53.3
|
References
Frequently Asked Questions
What is GHSA-p22h-3m2v-cmgh?
Which Github.com/cosmos/cosmos sdk versions are affected?
What version fixes GHSA-p22h-3m2v-cmgh?
Is github.com/cosmos/cosmos-sdk affected?
What CWE is associated with GHSA-p22h-3m2v-cmgh?
How can I check Go dependencies for GHSA-p22h-3m2v-cmgh?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p22h-3m2v-cmgh",
"modified" : "2025-07-08T23:33:08Z",
"published" : "2025-07-08T23:33:08Z",
"aliases" : [ ],
"summary" : "Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt",
"details" : "Description\nName: ISA-2025-005: Integer Overflow in Cosmos SDK\nComponent: CosmosSDK\nCriticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: <= v0.50.13, <= 0.53.2\nAffected users: Validators, Full nodes, Users on chains that utilize the distribution module\nCosmos SDK chains in unpatched releases that use the x/distribution module are affected.\n\nDescription\nAn issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state.\n\nPatches\nHas the problem been patched? What versions should users upgrade to?\n\nThe new Cosmos SDK release [v0.50.14](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.14) and [v0.53.3](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.53.3) fix this issue.\n\nThere are no known workarounds for this issue. It is advised that chains apply the update.\n\nThis issue was reported to the Cosmos Bug Bounty Program by `myte1111111` on HackerOne on April 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/cosmos/cosmos-sdk"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.50.14"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/cosmos/cosmos-sdk"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.52.0-alpha.1"
}, {
"fixed" : "0.53.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-p22h-3m2v-cmgh"
}, {
"type" : "WEB",
"url" : "https://github.com/cosmos/cosmos-sdk/commit/c4a14fa7b6828432fdabdb8b4af68ade9403ce49"
}, {
"type" : "WEB",
"url" : "https://github.com/cosmos/cosmos-sdk/commit/f2e6295b662fdb27ea33da1296c29588ccdaab42"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/cosmos/cosmos-sdk"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-190" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-07-08T23:33:08Z",
"nvd_published_at" : null
}
}