{"id":"GHSA-p22h-3m2v-cmgh","aliases":["GO-2025-3803"],"status":"published","title":"Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt","description":"Description\nName: ISA-2025-005: Integer Overflow in Cosmos SDK\nComponent: CosmosSDK\nCriticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: \u003c= v0.50.13, \u003c= 0.53.2\nAffected users: Validators, Full nodes, Users on chains that utilize the distribution module\nCosmos SDK chains in unpatched releases that use the x/distribution module are affected.\n\nDescription\nAn issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state.\n\nPatches\nHas the problem been patched? What versions should users upgrade to?\n\nThe new Cosmos SDK release [v0.50.14](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.14) and [v0.53.3](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.53.3) fix this issue.\n\nThere are no known workarounds for this issue. It is advised that chains apply the update.\n\nThis issue was reported to the Cosmos Bug Bounty Program by `myte1111111` on HackerOne on April 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-07-08T23:33:08Z","modified":"2025-07-28T20:42:20Z","fixes":[{"ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","fixed_in":["0.50.14","0.53.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.50.14"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.52.0-alpha.1"},{"fixed":"0.53.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.50.14"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0.52.0-alpha.1"},{"fixed":"0.53.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.50.14"},{"introduced":"0.52.0-alpha.1"},{"fixed":"0.53.3"}]}]}],"references":[{"url":"https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-p22h-3m2v-cmgh","tags":["web","advisory"]},{"url":"https://github.com/cosmos/cosmos-sdk/commit/c4a14fa7b6828432fdabdb8b4af68ade9403ce49","tags":["web","fix"]},{"url":"https://github.com/cosmos/cosmos-sdk/commit/f2e6295b662fdb27ea33da1296c29588ccdaab42","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-p22h-3m2v-cmgh"},{"url":"https://github.com/cosmos/cosmos-sdk","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-p22h-3m2v-cmgh","title":"Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt","description":"Description\nName: ISA-2025-005: Integer Overflow in Cosmos SDK\nComponent: CosmosSDK\nCriticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: \u003c= v0.50.13, \u003c= 0.53.2\nAffected users: Validators, Full nodes, Users on chains that utilize the distribution module\nCosmos SDK chains in unpatched releases that use the x/distribution module are affected.\n\nDescription\nAn issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state.\n\nPatches\nHas the problem been patched? What versions should users upgrade to?\n\nThe new Cosmos SDK release [v0.50.14](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.14) and [v0.53.3](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.53.3) fix this issue.\n\nThere are no known workarounds for this issue. It is advised that chains apply the update.\n\nThis issue was reported to the Cosmos Bug Bounty Program by `myte1111111` on HackerOne on April 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.","status":"published","published":"2025-07-08T23:33:08Z","modified":"2025-07-08T23:33:12Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"osv":[{"id":"GHSA-p22h-3m2v-cmgh","title":"Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt","description":"Description\nName: ISA-2025-005: Integer Overflow in Cosmos SDK\nComponent: CosmosSDK\nCriticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: \u003c= v0.50.13, \u003c= 0.53.2\nAffected users: Validators, Full nodes, Users on chains that utilize the distribution module\nCosmos SDK chains in unpatched releases that use the x/distribution module are affected.\n\nDescription\nAn issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state.\n\nPatches\nHas the problem been patched? What versions should users upgrade to?\n\nThe new Cosmos SDK release [v0.50.14](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.14) and [v0.53.3](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.53.3) fix this issue.\n\nThere are no known workarounds for this issue. It is advised that chains apply the update.\n\nThis issue was reported to the Cosmos Bug Bounty Program by `myte1111111` on HackerOne on April 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.","status":"published","published":"2025-07-08T23:33:08Z","modified":"2025-07-28T20:42:20.908326Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GO-2025-3803","title":"Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk","description":"Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk","status":"published","published":"2025-07-28T19:57:01Z","modified":"2025-07-28T20:42:20.908326Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}