How severe is GHSA-p22h-3m2v-cmgh?

No CVSS score has been assigned to GHSA-p22h-3m2v-cmgh yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-p22h-3m2v-cmgh?

GHSA-p22h-3m2v-cmgh affects the following packages: github.com/cosmos/cosmos-sdk (Go), github.com/cosmos/cosmos-sdk (Go). Ecosystems affected: Go.

How do I fix GHSA-p22h-3m2v-cmgh?

Update github.com/cosmos/cosmos-sdk to 0.50.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p22h-3m2v-cmgh is resolved across your whole dependency graph.

How do I detect GHSA-p22h-3m2v-cmgh in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cosmos/cosmos-sdk, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-p22h-3m2v-cmgh if there is no patch (or I can't update yet)?

Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Is GHSA-p22h-3m2v-cmgh actively exploited in the wild?

No public exploit code has been indexed for GHSA-p22h-3m2v-cmgh yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-p22h-3m2v-cmgh published, and has it been updated?

GHSA-p22h-3m2v-cmgh was published on July 8, 2025 and was last updated on July 28, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

Not in CISA KEV

Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain haltGHSA-p22h-3m2v-cmgh

Fix: cosmos/cosmos-sdk@c4a14fa

GHSA-p22h-3m2v-cmgh is a remote code execution vulnerability in github.com/cosmos/cosmos-sdk. A fix is available for github.com/cosmos/cosmos-sdk — see the affected versions and patch details below.

Also known asGO-2025-3803

Published

Jul 8, 2025

Updated

Jul 28, 2025

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Jul 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

🐹github.com/cosmos/cosmos-sdk🐹github.com/cosmos/cosmos-sdk

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.50.13, <= 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK chains in unpatched releases that use the x/distribution module are affected.

Description An issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would result in an integer overflow that would cause a chain halt. A malicious validator can interact with the distribution module to introduce this state.

Patches Has the problem been patched? What versions should users upgrade to?

The new Cosmos SDK release v0.50.14 and v0.53.3 fix this issue.

There are no known workarounds for this issue. It is advised that chains apply the update.

This issue was reported to the Cosmos Bug Bounty Program by myte1111111 on HackerOne on April 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If you have questions about Interchain security efforts, please reach out to our official communication channel at [email protected]. For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/cosmos/cosmos-sdk`	all versions	0.50.14`go get github.com/cosmos/cosmos-sdk@v0.50.14`
🐹Go	`github.com/cosmos/cosmos-sdk`	≥ 0.52.0-alpha.1&&< 0.53.3	0.53.3`go get github.com/cosmos/cosmos-sdk@v0.53.3`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cosmos/cosmos-sdk, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/cosmos/cosmos-sdk to 0.50.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p22h-3m2v-cmgh is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Frequently Asked Questions

Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md)) Affected versions: <= v0.50.13, <= 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK chains in unpatched releases that use the x/distribution module are affected. Description An issue was discovered in the distribution module where a malicious deposit into the Validator Rewards pool would resu

O3 Security · Impact-Aware SCA

Is GHSA-p22h-3m2v-cmgh in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works