VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/cosmos/ibc-go: vulnerability history, versions and safety

github.com/cosmos/ibc-go is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from May 2024 to Mar 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
6 vulnerabilities recorded C2 U4
i
5 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/cosmos/ibc-go vulnerabilities

Vulert verdict on github.com/cosmos/ibc-go v1.5.0 i

Updated on 23 Oct 2026

Careful: v1.5.0 has 6 known vulnerabilities, and 5 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Some issues to review
  • Maintenance Slowing
  • Popularity Widely used
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.5.0 — affected i
  • Vulnerabilities on record 6 over 1 year · 0 in the last year i
  • Latest disclosure 18 Mar 2025 i
  • Highest CVSS 9.3 i
  • With no published fix 5 i
  • Stars 647 i
  • OpenSSF scorecard 7/10 i
  • Last release 52 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/cosmos/ibc-go, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.2.7 15 Oct 2022 C2 U4 MIT No Details →
v1.1.7 15 Oct 2022 C2 U4 MIT No Details →
v1.5.0 14 Jun 2022 C2 U4 MIT No Details →
v1.4.1 14 Jun 2022 C2 U4 MIT No Details →
v1.3.1 14 Jun 2022 C2 U4 MIT No Details →
v1.4.0 15 Mar 2022 C2 U4 MIT No Details →
v1.3.0 15 Mar 2022 C2 U4 MIT No Details →
v1.1.5-fix 05 Feb 2022 C2 U4 MIT No Details →
v1.1.6-0.20220205145853-f6295a2c7ee4 05 Feb 2022 C2 U4 MIT No Details →
v1.2.6 03 Feb 2022 C2 U4 MIT No Details →
v1.1.6 03 Feb 2022 C2 U4 MIT No Details →
v1.1.5 15 Dec 2021 C2 U4 MIT No Details →
v1.2.5 15 Dec 2021 C2 U4 MIT No Details →
v1.2.4 06 Dec 2021 C2 U4 MIT No Details →
v1.1.4 06 Dec 2021 C2 U4 MIT No Details →
v1.2.1-0.20211111105346-12a60b13a024 11 Nov 2021 C2 U4 MIT No Details →
v1.2.3 09 Nov 2021 C2 U4 MIT No Details →
v1.1.3 09 Nov 2021 C2 U4 MIT No Details →
v1.2.2 15 Oct 2021 C2 U4 MIT No Details →
v1.1.2 15 Oct 2021 C2 U4 MIT No Details →
v1.2.1 04 Oct 2021 C2 U4 MIT No Details →
v1.1.1 04 Oct 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210920145633-e7cf4d31da68 20 Sep 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210913140640-7a6507b460c4 13 Sep 2021 C2 U4 MIT No Details →
v1.2.0 10 Sep 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210910111834-06c2d764df59 10 Sep 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210907102815-396186b0f1e1 07 Sep 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210906112230-90ce97e8409b 06 Sep 2021 C2 U4 MIT No Details →
v1.1.0 03 Sep 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210827143044-6195e5b78b75 27 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210827135433-9d5da1760d3c 27 Aug 2021 C2 U4 MIT No Details →
v1.0.1 25 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210825140746-ae36ab5ba5c6 25 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210812133141-2c5ea11e4a2c 12 Aug 2021 C2 U4 MIT No Details →
v1.0.0 10 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210810134404-3dade920d030 10 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210809094211-881276fd3372 09 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210809092208-6c3b5829eaa2 09 Aug 2021 C2 U4 MIT No Details →
v1.0.0-rc3.0.20210805131028-160f010e48a6 05 Aug 2021 C2 U4 MIT No Details →
v1.0.0-rc4 05 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210805131008-36429830c895 05 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210802140125-e66b5cec6313 02 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210802135831-0e3c462d0f1d 02 Aug 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210729155445-a9cdf5aeb6b5 29 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210727145513-da40d5577ce8 27 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210726133116-6f10a68440a6 26 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210723121034-c3be1692adc3 23 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc2.0.20210721130538-0d9eef8925fd 21 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc3 21 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc1.0.20210720132707-2195145fcc6f 20 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc2 20 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210720131520-c623ad7d147a 20 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210719154617-76ad03e97dda 19 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc0.0.20210715153725-50e118e1381f 15 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc1 15 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210715094356-099d7042a5b9 15 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210707133147-99824784d5a6 07 Jul 2021 C2 U4 MIT No Details →
v1.0.0-rc0 07 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210707132717-ca7f92d0a173 07 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210707124614-980e185df6b9 07 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210706155847-544e9cc04621 06 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210706145512-449847bd7af8 06 Jul 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210618135238-38b50b2c58f4 18 Jun 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210618131814-5ddd31bd017a 18 Jun 2021 C2 U4 MIT No Details →
v1.0.0-beta1.0.20210617120710-d9d76d7423e1 17 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210617114356-2e95805e2d47 17 Jun 2021 C2 U4 MIT No Details →
v1.0.0-beta1 17 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210616153427-fed9443e27eb 16 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210615132841-bae186278390 15 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210615093027-ca070bd2c6aa 15 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210610121502-a970700e0d53 10 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210609164250-2548ab5f52d3 09 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210603063624-832044782f10 03 Jun 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210528092842-4bb1960fe4a1 28 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210527114332-79659be7bf52 27 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210527110404-665287d12f46 27 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210527100633-269164c229b2 27 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210526194707-ddeb58ecbc10 26 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524155708-457095517b78 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524133806-0991cac8dbe4 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524133617-53b5a2060ae9 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524132918-400791803967 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524132141-78c3ca0a7de3 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524111351-8171ec1b3d3b 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210524110422-f35fc6069db5 24 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210512161830-f4123347754d 12 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2.0.20210512114443-6dbf32f38ee3 12 May 2021 C2 U4 MIT No Details →
v0.0.0-20210512102437-d70f49c8f612 12 May 2021 C2 U4 MIT No Details →
v1.0.0-alpha2 12 May 2021 C2 U4 MIT No Details →
v0.0.0-20210510173110-e057e0b14ec3 10 May 2021 C2 U4 MIT No Details →
v0.0.0-20210510165156-5991e8630dbf 10 May 2021 C2 U4 MIT No Details →
v0.0.0-20210506172029-6537f2488127 06 May 2021 C2 U4 MIT No Details →
v0.0.0-20210506105556-146bc93795ad 06 May 2021 C2 U4 MIT No Details →
v0.0.0-20210423194602-239301e2599d 23 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210423093904-0f94f1784c01 23 Apr 2021 C2 U4 MIT No Details →
v1.0.0-alpha1 23 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210422093844-db6f316cb044 22 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210421162303-ca1fe48a3f57 21 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210421093045-3a61a65d245c 21 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210420144420-525ffc4d0143 20 Apr 2021 C2 U4 MIT No Details →
v0.0.0-20210419101509-39ba1af72319 19 Apr 2021 C2 U4 — No Details →
v0.0.0-20210414165339-5d3a80060ed4 14 Apr 2021 C2 U4 — No Details →
v0.0.0-20210414160111-7e673b9dad20 14 Apr 2021 C2 U4 — No Details →
v0.0.0-20210413100525-0174312bc7ed 13 Apr 2021 C2 U4 — No Details →
v0.0.0-20210413095857-e12261ce54ef 13 Apr 2021 C2 U4 — No Details →
v0.0.0-20210412182057-4e145d807b55 12 Apr 2021 C2 U4 — No Details →
v0.0.0-20210412102323-e98838612a4f 12 Apr 2021 C2 U4 — No Details →
v0.0.0-20210406112011-58df13ca2847 06 Apr 2021 C2 U4 — No Details →
v0.0.0-20210402204812-ed1f7cf3c56d 02 Apr 2021 C2 U4 — No Details →
v0.0.0-20210330211706-07b6a97b67d1 30 Mar 2021 C2 U4 — No Details →
v0.0.0-20210325105830-372eaa42a908 25 Mar 2021 C2 U4 — No Details →
v0.0.0-20210323141340-8435875aab37 23 Mar 2021 C2 U4 — No Details →
v0.0.0-20210323113601-48af41240218 23 Mar 2021 C2 U4 — No Details →
v0.0.0-20210322221640-9c6edc4bb828 22 Mar 2021 C2 U4 — No Details →
v0.0.0-20210322220906-e9290f5e9a75 22 Mar 2021 C2 U4 — No Details →
v0.0.0-20210322173322-e226f369c7ad 22 Mar 2021 C2 U4 — No Details →
v0.0.0-20210317150741-5c504640cdb6 17 Mar 2021 C2 U4 — No Details →
v0.0.0-20210317150152-2c38c0b23077 17 Mar 2021 C2 U4 — No Details →
v0.0.0-20210312172444-333c1f338b2a 12 Mar 2021 C2 U4 — No Details →
v0.0.0-20210312120350-b8219eb0c611 12 Mar 2021 C2 U4 — No Details →

The newest 120 of 131 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 2
  • 2025 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 6 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/cosmos/ibc-go

The 5 most severe of 6 vulnerabilities recorded for this package

Search all 6 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Critical Non-deterministic JSON Unmarshalling Vulnerability in IBC-Go 9.3 critical No fix published 28 Feb 2025
Reentrancy Vulnerability in ibc-hooks in github.com/cosmos/ibc-go N/A unrated No fix published 20 May 2024
Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go N/A unrated No fix published 23 May 2024
Non-deterministic JSON Unmarshalling Vulnerability in IBC-Go Package N/A unrated No fix published 05 Mar 2025
IBC-Go Vulnerability: Non-deterministic JSON Unmarshalling Leading to Potential Chain Halt N/A critical 7.10.0 12 Mar 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/cosmos/ibc-go

Is github.com/cosmos/ibc-go safe to use?

Vulert records 6 vulnerabilities for github.com/cosmos/ibc-go in Go: 2 critical, 0 high, 0 medium and 0 low, plus 4 not yet rated. 5 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/cosmos/ibc-go's Vulert package health score?

Vulert scores github.com/cosmos/ibc-go 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/cosmos/ibc-go affected?

Yes. v1.5.0, the version you would install today, has 6 known vulnerabilities, and 5 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/cosmos/ibc-go have?

6 vulnerabilities are recorded for github.com/cosmos/ibc-go in the Go ecosystem: 2 critical, 0 high, 0 medium and 0 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/cosmos/ibc-go vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/cosmos/ibc-go in the last 12 months, and the oldest entry in this database dates to 20 May 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/cosmos/ibc-go are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/cosmos/ibc-go for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/cosmos/ibc-go version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.