Security advisories

high2025-07-08

Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt

GHSA-p22h-3m2v-cmgh

high2025-03-12

Cosmos SDK: x/group can halt when erroring in EndBlocker

GHSA-47ww-ff84-4jrg

high2025-02-20

Cosmos SDK: Groups module can halt chain when handling a malicious proposal

GHSA-x5vx-95h7-rv4p

high2024-12-16

ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion

GHSA-8wcc-m6j2-qxvm

high2024-11-20

ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic

GHSA-7225-m954-23v7

high2024-03-12

ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions

GHSA-95rx-m9m5-m94v

low2024-02-27

ASA-2024-005: Potential slashing evasion during re-delegation

GHSA-86h5-xcpx-cfqc

medium2024-02-21

ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`

GHSA-2557-x9mg-76w8

medium2024-02-21

ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module

GHSA-4j93-fm92-rp4m

medium2023-09-06

Cosmos-SDK Cosmovisor component may be vulnerable to denial of service

GHSA-23px-mw2p-46qm

medium2023-07-07

Barberry Security Advisory - regarding x/auth periodic vesting accounts

GHSA-j2cr-jc39-wpx5

low2023-06-30

github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee

GHSA-w5w5-2882-47pc

low2023-06-02

Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt

GHSA-qfc5-6r3j-jj22

medium2021-10-21

Authz Module Non-Determinism

GHSA-2p6r-37p9-89p2 · CVE-2021-41135