Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk

GHSA-x5vx-95h7-rv4p · GO-2025-3476 · Published 03/03/2025 · updated 03/03/2025

In short

GO-2025-3476 is a not yet rated vulnerability affecting github.com/cosmos/cosmos-sdk.
Fix: update to 0.50.12, 0.47.16-ics-lsm or later.

Package	Affected versions	Patched versions
github.com/cosmos/cosmos-sdk Go	`≥ 0.50.0-alpha.0, < 0.50.12< 0.47.16-ics-lsm`	`0.50.120.47.16-ics-lsm`

Running one of these products? Scan your site to see whether it exposes a vulnerable version.