GHSA-h2rp-8vpx-q9r4 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)
Attackers can halt the blockchain network by exploiting non-deterministic JSON unmarshalling and error handling flaws in IBC-Go and Cosmos SDK dependencies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h2rp-8vpx-q9r4?
GHSA-h2rp-8vpx-q9r4 is a denial of service vulnerability in github.com/cheqd/cheqd-node, published on 13 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
Impact
If unaddressed, this could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
Which versions are affected by GHSA-h2rp-8vpx-q9r4?
3 open source packages ship an affected version, including github.com/cheqd/cheqd-node.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cheqd/cheqd-node Go | All versions | None |
github.com/cheqd/cheqd-node Go | All versions | 3.1.8 |
github.com/cheqd/cheqd-node Go | All versions | 3.1.8 |
How do I fix GHSA-h2rp-8vpx-q9r4?
Upgrade github.com/cheqd/cheqd-node to 3.1.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-h2rp-8vpx-q9r4 being exploited?
There is no known exploitation of GHSA-h2rp-8vpx-q9r4 in the wild and no public exploit code.
Sources
Also known as GO-2025-3520.