GHSA-h2rp-8vpx-q9r4
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)
GHSA-h2rp-8vpx-q9r4 is a vulnerability with no CVSS score yet in github.com/cheqd/cheqd-node, published March 13, 2025. No source lists public exploit code. Fixed in github.com/cheqd/cheqd-node 3.1.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.8github.com/cheqd/cheqd-node +1 more
Description
Description
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
Impact
If unaddressed, this could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cheqd/cheqd-nodeGo | before 3.1.8 | 3.1.8 |
github.com/cheqd/cheqd-nodeGo | All versions | None known |
What each source reports
GitHub AdvisoriesNo score
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)
Description
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
Impact
If unaddressed, this could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
- Record
GHSA-h2rp-8vpx-q9r4- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVNo score
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)
Description
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
Impact
If unaddressed, this could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
- Record
GHSA-h2rp-8vpx-q9r4- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVGO-2025-3520No score
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) in github.com/cheqd/cheqd-node
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) in github.com/cheqd/cheqd-node.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/cheqd/cheqd-node before v3.1.8.
- Record
GO-2025-3520- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/cheqd/cheqd-node/security/advisories/GHSA-h2rp-8vpx-q9r4