Live › vulnerability › GHSA-86h5-xcpx-cfqc
Go to dashboardA flaw in the Cosmos SDK Go module lets a validator avoid slashing penalties it should receive. The sources do not say what triggers it or how much impact it has on a live chain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
Chains and applications built on the Cosmos SDK module from 0.50.0 up to but not including 0.50.5 are listed as affected by the govuln entry. The sources do not say whether older 0.47 releases or non-validator setups are affected beyond the fixed versions given.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/cosmos/cosmos-sdk | go | >= 0.50.0, < 0.50.5 | 0.47.10, 0.50.5 |
go list -m github.com/cosmos/cosmos-sdk in the chain or application module to read the resolved version.0.50.5 on the 0.50 line, or below 0.47.10 on the 0.47 line.github.com/cosmos/cosmos-sdk to 0.50.5 or later on the 0.50 line, or to 0.47.10 or later on the 0.47 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Slashing evasion in github.com/cosmos/cosmos-sdk
This page as .md · .json · in your agent: get_signal("GHSA-86h5-xcpx-cfqc")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.