GHSA-6fgm-x6ff-w78f Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain
Attackers can cause a denial of service in IBC transfers to native chains using affected Packet Forward Middleware versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6fgm-x6ff-w78f?
GHSA-6fgm-x6ff-w78f is a denial of service vulnerability in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.
We recommend upgrading as soon as possible.
THIS IS A STATE BREAKING CHANGE
Patches
Versions 7.2.1 and 8.1.1 are patched.
Workarounds
N/A
References
N/A
Which versions are affected by GHSA-6fgm-x6ff-w78f?
15 open source packages ship an affected version, including github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 and github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | None |
9 more packages
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | None |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 Go | All versions | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 Go | All versions | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 Go | All versions | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8 Go | All versions | 8.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8 Go | All versions | 8.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8 Go | All versions | 8.1.1 |
How do I fix GHSA-6fgm-x6ff-w78f?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-6fgm-x6ff-w78f being exploited?
There is no known exploitation of GHSA-6fgm-x6ff-w78f in the wild and no public exploit code.
Sources
Also known as GO-2025-3463.