{"id":"GHSA-86h5-xcpx-cfqc","kind":"vulnerability","aliases":["GHSA-86h5-xcpx-cfqc","GO-2024-2584"],"related":[],"title":"Slashing evasion in github.com/cosmos/cosmos-sdk","description":"Slashing evasion in github.com/cosmos/cosmos-sdk","summary":"A flaw in the Cosmos SDK Go module lets a validator avoid slashing penalties it should receive. The sources do not say what triggers it or how much impact it has on a live chain.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cosmos/cosmos-sdk","fixed":["0.47.10","0.50.5"],"affected":">= 0.50.0, < 0.50.5","ecosystem":"go"}],"ecosystems":["go"],"tags":["blockchain","cosmos-sdk","go","package","validators"],"not_affected_if":["version-at-or-above-fixed"],"how_to_check":"- Run `go list -m github.com/cosmos/cosmos-sdk` in the chain or application module to read the resolved version.\n- Check that the version is below `0.50.5` on the 0.50 line, or below `0.47.10` on the 0.47 line.","fix":"- Upgrade `github.com/cosmos/cosmos-sdk` to `0.50.5` or later on the 0.50 line, or to `0.47.10` or later on the 0.47 line.","status":"open","published_at":"2024-03-05T19:43:51+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-25T05:41:35+00:00","updated_at":"2026-10-25T05:41:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:41:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `github.com/cosmos/cosmos-sdk` to `0.50.5` or later on the 0.50 line, or to `0.47.10` or later on the 0.47 line.","reach":"unknown","title":"Cosmos SDK: validators can evade slashing penalties on chain","impact":"medium","summary":"A flaw in the Cosmos SDK Go module lets a validator avoid slashing penalties it should receive. The sources do not say what triggers it or how much impact it has on a live chain.","category":"package","nicknames":[],"who_cares":["cosmos-sdk","go","blockchain","validators"],"confidence":0.6,"needs_auth":"unknown","worst_case":"validator evades slashing penalties it should incur","analyst_note":"Sources give only a one-line description; check https://pkg.go.dev/vuln/GO-2024-2584 and GHSA-86h5-xcpx-cfqc for the trigger, the required network role and exploitation conditions.","how_to_check":"- Run `go list -m github.com/cosmos/cosmos-sdk` in the chain or application module to read the resolved version.\n- Check that the version is below `0.50.5` on the 0.50 line, or below `0.47.10` on the 0.47 line.","needs_analyst":true,"not_affected_if":["version-at-or-above-fixed"],"who_is_affected":"Chains and applications built on the Cosmos SDK module from 0.50.0 up to but not including 0.50.5 are listed as affected by the govuln entry. The sources do not say whether older 0.47 releases or non-validator setups are affected beyond the fixed versions given.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3297,"output_tokens":604,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':13A '-2584':14A '/cosmos/cosmos-sdk':6A,22A,70C '86h5':9A,17A 'avoid':41B 'blockchain':23B 'cfqc':11A,19A 'chain':64B 'cosmos':25B,34B 'cosmos-sdk':24B 'evas':2A,66C 'flaw':31B 'ghsa':8A,16A 'ghsa-86h5-xcpx-cfqc':7A,15A 'github.com':5A,21A,69C 'github.com/cosmos/cosmos-sdk':4A,20A,68C 'go':12A,27B,36B 'impact':58B 'let':38B 'live':63B 'modul':37B 'much':57B 'packag':28B 'penalti':43B 'receiv':46B 'say':51B 'sdk':26B,35B 'slash':1A,42B,65C 'sourc':48B 'trigger':53B 'valid':29B,40B 'xcpx':10A,18A","nicknames":[],"mitigations":[],"who_affected":"Chains and applications built on the Cosmos SDK module from 0.50.0 up to but not including 0.50.5 are listed as affected by the govuln entry. The sources do not say whether older 0.47 releases or non-validator setups are affected beyond the fixed versions given.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-03-05T19:43:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2024-2584","url":"https://pkg.go.dev/vuln/GO-2024-2584","severity":null,"published_at":"2024-03-05T19:43:51+00:00","modified_at":"2026-10-01T20:24:15+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}