GHSA-6fgm-x6ff-w78f
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain
Impact
Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.
We recommend upgrading as soon as possible.
THIS IS A STATE BREAKING CHANGE
Patches
Versions 7.2.1 and 8.1.1 are patched.
Workarounds
N/A
References
N/A
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain
Impact
Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.
We recommend upgrading as soon as possible.
THIS IS A STATE BREAKING CHANGE
Patches
Versions 7.2.1 and 8.1.1 are patched.
Workarounds
N/A
References
N/A
- Record
GHSA-6fgm-x6ff-w78f- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSV
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain
Impact
Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain.
We recommend upgrading as soon as possible.
THIS IS A STATE BREAKING CHANGE
Patches
Versions 7.2.1 and 8.1.1 are patched.
Workarounds
N/A
References
N/A
- Record
GHSA-6fgm-x6ff-w78f- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVGO-2025-3463No score
DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
- Record
GO-2025-3463- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7Go | before 7.2.1 | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8Go | before 8.1.1 | 8.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4Go | before 7.2.1 | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5Go | before 7.2.1 | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6Go | before 7.2.1 | 7.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4Go | All versions | None known |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5Go | All versions | None known |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6Go | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-6fgm-x6ff-w78f is a medium vulnerability (CVSS 6.9) in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7, published February 12, 2025. No source lists public exploit code. Fixed in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 7.2.1.
References
github.com/cosmos/ibc-apps/security/advisories/GHSA-6fgm-x6ff-w78f