—
GO-2025-3476
Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk
Quick fix
GO-2025-3476 — github.com/cosmos/cosmos-sdk: upgrade to the fixed version with the command below.
go get github.com/cosmos/cosmos-sdk@v0.47.16-ics-lsmDetails
Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/cosmos/cosmos-sdk
Introduced in:
0Fixed in: 0.47.16-ics-lsmFix
go get github.com/cosmos/cosmos-sdk@v0.47.16-ics-lsmReferences
- https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-x5vx-95h7-rv4p[ADVISORY]
- https://github.com/cosmos/cosmos-sdk/commit/0a98b65b24900a0e608866c78f172cf8e4140aea[FIX]
- https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.16[WEB]
- https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.12[WEB]