{"schema_version":"1.3.1","id":"GO-2024-3339","modified":"2024-12-20T21:48:20Z","published":"2024-12-18T16:35:57Z","aliases":["GHSA-8wcc-m6j2-qxvm"],"summary":"Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk","details":"Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk","affected":[{"package":{"name":"cosmossdk.io/x/tx","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.7"}]}],"ecosystem_specific":{"imports":[{"path":"cosmossdk.io/x/tx/decode","symbols":["Decoder.Decode","RejectUnknownFields","RejectUnknownFieldsStrict"]}]}},{"package":{"name":"github.com/cosmos/cosmos-sdk","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.47.15"},{"introduced":"0.50.0-alpha.0"},{"fixed":"0.50.11"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cosmos/cosmos-sdk/codec/types","symbols":["interfaceRegistry.UnpackAny"]},{"path":"github.com/cosmos/cosmos-sdk/codec/unknownproto","symbols":["RejectUnknownFields","RejectUnknownFieldsStrict"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm"},{"type":"FIX","url":"https://github.com/cosmos/cosmos-sdk/commit/c6b1bdcd5628e3e425a3f02881d3c7db1d7af653"},{"type":"WEB","url":"https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.15"},{"type":"WEB","url":"https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.11"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-3339","review_status":"REVIEWED"}}