GHSA-j2cr-jc39-wpx5

Barberry Security Advisory - regarding x/auth periodic vesting accounts

No scoreFix available

Impact

In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able to withdraw them.

Patches

>= v0.46.13 for Cosmos SDK v0.46.x >= v0.47.3 for Cosmos SDK v0.47.x

If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too.

Workarounds

There is no workaround for this issue. Upgrade immediately.

References

Patched versions release notes: v0.47.3, v0.46.13.
Forum Post

What each source reports

GitHub AdvisoriesNo score

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact

Patches

>= v0.46.13 for Cosmos SDK v0.46.x >= v0.47.3 for Cosmos SDK v0.47.x

If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too.

Workarounds

There is no workaround for this issue. Upgrade immediately.

References

Patched versions release notes: v0.47.3, v0.46.13.
Forum Post

Record: GHSA-j2cr-jc39-wpx5
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w44m-8mv2-v78hNo score

Duplicate Advisory: Cosmos "Barberry" vulnerability in github.com/cosmos/cosmos-sdk

Withdrawn

This advisory has been withdrawn because it is a duplicate of GHSA-j2cr-jc39-wpx5. This link is maintained to preserve external references.

Original Description

The cosmos-sdk module is affected by the vulnerability codenamed "Barberry".

Record: GHSA-w44m-8mv2-v78h
Updated: 2026-11-02

OSVNo score

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact

Patches

>= v0.46.13 for Cosmos SDK v0.46.x >= v0.47.3 for Cosmos SDK v0.47.x

If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too.

Workarounds

There is no workaround for this issue. Upgrade immediately.

References

Patched versions release notes: v0.47.3, v0.46.13.
Forum Post

Record: GHSA-j2cr-jc39-wpx5
Updated: 2026-11-02

OSVGHSA-w44m-8mv2-v78hNo score

Duplicate Advisory: Cosmos "Barberry" vulnerability in github.com/cosmos/cosmos-sdk

Withdrawn

This advisory has been withdrawn because it is a duplicate of GHSA-j2cr-jc39-wpx5. This link is maintained to preserve external references.

Original Description

The cosmos-sdk module is affected by the vulnerability codenamed "Barberry".

Record: GHSA-w44m-8mv2-v78h
Updated: 2026-11-02

OSVGO-2023-1861No score

Cosmos "Barberry" vulnerability in github.com/cosmos/cosmos-sdk

The cosmos-sdk module is affected by the vulnerability codenamed "Barberry".

Record: GO-2023-1861
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/cosmos/cosmos-sdk` Go	0.46.0 to 0.46.12	0.46.13
`github.com/cosmos/cosmos-sdk` Go	0.47.0 to 0.47.2	0.47.3
`github.com/cosmos/cosmos-sdk` Go	0.46.0 up to 0.46.13	0.46.13
`github.com/cosmos/cosmos-sdk` Go	0.47.0 up to 0.47.3	0.47.3
`github.com/cosmos/cosmos-sdk` Go	before 0.46.13, 0.47.0 up to 0.47.3	0.46.130.47.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-j2cr-jc39-wpx5 is a vulnerability with no CVSS score yet in github.com/cosmos/cosmos-sdk, published June 22, 2023. No source lists public exploit code. Fixed in github.com/cosmos/cosmos-sdk 0.46.13.