Uncontrolled Recursion Affecting github.com/cosmos/cosmos-sdk/codec/unknownproto package, versions <0.47.15>=0.50.0-alpha.0 <0.50.11
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Uncontrolled Recursion vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMCOSMOSCOSMOSSDKCODECUNKNOWNPROTO-8516100
- published17 Dec 2024
- disclosed16 Dec 2024
- creditLonelySloth
Introduced: 16 Dec 2024
New CVE NOT AVAILABLE CWE-400 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/cosmos/cosmos-sdk/codec/unknownproto to version 0.47.15, 0.50.11 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Recursion through the UnpackAny function. An attacker can cause the application to consume excessive CPU and memory resources by sending specially crafted transaction messages that exploit the lack of validation for nested message structures.