GHSA-qjcv-rx3v-7mvj

github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability

No scoreFix available

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability.

What each source reports

GitHub AdvisoriesNo score

github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability.

Record: GHSA-qjcv-rx3v-7mvj
Updated: 2026-11-02

OSVNo score

github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability.

Record: GHSA-qjcv-rx3v-7mvj
Updated: 2026-11-02

OSVGO-2024-2874No score

Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability. The vulnerability allowed an attacker to send arbitrary transactions onto target chains and trigger arbitrary state transitions, including but not limited to, theft of funds. It was possible to exploit this vulnerability in specific situations involving relaying packets in which the source chain is also the final destination chain. Affected networks are those that allow for fee grant capabilities and use a native Relayer (e.g., Osmosis and Juno).

Record: GO-2024-2874
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/cosmos/ibc-go/v7` Go	before 7.0.1	7.0.1
`github.com/cosmos/ibc-go/v6` Go	before 6.1.1	6.1.1
`github.com/cosmos/ibc-go/v5` Go	before 5.2.1	5.2.1
`github.com/cosmos/ibc-go/v5` Go	5.3.0 up to 5.3.1	5.3.1
`github.com/cosmos/ibc-go/v4` Go	before 4.1.3	4.1.3
`github.com/cosmos/ibc-go/v4` Go	4.2.0 up to 4.2.2	4.2.2
`github.com/cosmos/ibc-go/v4` Go	4.3.0 up to 4.3.1	4.3.1
`github.com/cosmos/ibc-go/v4` Go	4.4.0 up to 4.4.1	4.4.1
`github.com/cosmos/ibc-go/v3` Go	through 3.4.0	None known
`github.com/cosmos/ibc-go/v2` Go	through 2.5.0	None known

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`github.com/cosmos/ibc-go` Go	through 1.5.0	None known
`github.com/cosmos/ibc-go` Go	All versions	None known
`github.com/cosmos/ibc-go/v2` Go	All versions	None known
`github.com/cosmos/ibc-go/v3` Go	All versions	None known
`github.com/cosmos/ibc-go/v4` Go	All versions	None known
`github.com/cosmos/ibc-go/v5` Go	All versions	None known
`github.com/cosmos/ibc-go/v6` Go	All versions	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-qjcv-rx3v-7mvj is a vulnerability with no CVSS score yet in github.com/cosmos/ibc-go, published May 20, 2024. No source lists public exploit code. Fixed in github.com/cosmos/ibc-go/v7 7.0.1.

What each source reports

Affected packages

History

In short

References