x/vulndb: potential Go vuln in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8: GHSA-6fgm-x6ff-w78f

[GoVulnBot]

Advisory GHSA-6fgm-x6ff-w78f references a vulnerability in the following Go modules:

Module
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8

Description:

Impact

Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.

We recommend upgrading as soon as possible.

THIS IS A STATE BREAKING CHANGE

Patches

Versions 7.2.1 and [8.1.1](https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2F...

References:

• ADVISORY: GHSA-6fgm-x6ff-w78f
• ADVISORY: GHSA-6fgm-x6ff-w78f
• WEB: https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv7.2.1
• WEB: https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv8.1.1

Cross references:

• github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 appears in 1 other report(s):
  • data/reports/GO-2023-2156.yaml (x/vulndb: potential Go vuln in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6: GHSA-w6rp-vxj2-fjhr #2156)
• github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 appears in 1 other report(s):
  • data/reports/GO-2023-2156.yaml (x/vulndb: potential Go vuln in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6: GHSA-w6rp-vxj2-fjhr #2156)
• github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 appears in 1 other report(s):
  • data/reports/GO-2023-2156.yaml (x/vulndb: potential Go vuln in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6: GHSA-w6rp-vxj2-fjhr #2156)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4
      vulnerable_at: 4.1.2
    - module: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5
      vulnerable_at: 5.2.2
    - module: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6
      vulnerable_at: 6.1.2
    - module: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7
      versions:
        - fixed: 7.2.1
      vulnerable_at: 7.2.0
    - module: github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8
      versions:
        - fixed: 8.1.1
      vulnerable_at: 8.1.0
summary: |-
    Potential Denial-of-Service condition leading to temporary disability in IBC
    transfers to the native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
ghsas:
    - GHSA-6fgm-x6ff-w78f
references:
    - advisory: https://github.com/advisories/GHSA-6fgm-x6ff-w78f
    - advisory: https://github.com/cosmos/ibc-apps/security/advisories/GHSA-6fgm-x6ff-w78f
    - web: https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv7.2.1
    - web: https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv8.1.1
source:
    id: GHSA-6fgm-x6ff-w78f
    created: 2025-02-12T23:03:21.842635026Z
review_status: UNREVIEWED