{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cosmos/evm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T14:53:51Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "**Advisory ID:** ASA-2026-002\n\n**Component:** ICS20 Precompile\n\n**Status:** Resolved\n\n**Published:** March 2026\n\n**Contact:** [security@cosmoslabs.io](mailto:security@cosmoslabs.io)\n\n---\n\n# Security Advisory ASA-2026-002\n\n**Status: Resolved. A patch is available and all known affected chains have either applied mitigations or [upgraded](https://github.com/cosmos/evm/releases/tag/v0.6.0).**\n\n| Field | Value |\n| --- | --- |\n| **Severity** | Critical |\n| **Affected Component** | ICS20 Precompile |\n| **Affected Versions** | Cosmos EVM implementations including the ICS20 precompile |\n| **Patched Version** | [v0.6.0](https://github.com/cosmos/evm/releases/tag/v0.6.0) |\n| **First Reported** | January 21, 2026 |\n| **Public Disclosure** | March 2026 |\n\n---\n\n## Introduction\n\nRecently, there was a vulnerability affecting a feature used by some chains built on the Cosmos EVM stack.  Working together with ecosystem partners and affected teams, particularly Saga, B-Harvest, Mantra, Zellic and Sherlock, Cosmos Labs  investigated the issue, coordinated mitigations, developed a permanent fix, and issued a patch to affected chains.\n\nWe appreciate the collaboration of the teams who assisted during the investigation and response process and thank our ecosystem partners for their support in coordinating mitigation and validation efforts.\n\n---\n\n## Remediation Summary\n\nOn January 21, 2026, Cosmos Labs was notified of suspicious activity on a network running the affected implementation. The issue resulted in financial loss on the Saga EVM network.\n\nAfter confirming the vulnerability, Cosmos Labs coordinated with the affected chain team and ecosystem partners to investigate the issue, deploy mitigations, and assist other chains running the affected code.\n\nCosmos Labs contacted chains known to be running versions containing the affected component to verify their configurations and support mitigation where necessary. At the time of publication, all known affected chains have either applied mitigations or upgraded to a patched version.\n\n---\n\n## Root Cause\n\nThe vulnerability was caused by incorrect state handling during nested EVM execution paths involving the ICS20 precompile.\n\nUnder certain execution conditions, state updates performed during recursive calls were not correctly reflected in the outer execution context. This could allow repeated use of the same token balance within a single transaction.\n\n---\n\n## Mitigation\n\nAs an immediate mitigation, chains were advised to disable the ICS20 precompile through a coordinated upgrade.\n\nCosmos Labs assisted ecosystem teams in verifying whether their chains were affected and in applying the mitigation where required.\n\n- 15 chains were identified as running code containing the issue\n- 6 chains did not have the affected feature enabled\n- The remaining chains implemented the mitigation before exploitation occurred\n- 1 chain experienced an exploit prior to mitigation\n\n---\n\n## Long-Term Fix\n\nA permanent fix was implemented to ensure state consistency across nested EVM execution paths. The patch was distributed privately to affected teams for validation and later released publicly.\n\nThe fix is included in **[v0.6.0](https://github.com/cosmos/evm/releases/tag/v0.6.0)**.\n\n---\n\n## Am I Affected?\n\nChains may be affected if they:\n\n- Run versions of the Cosmos EVM stack that include the ICS20 precompile implementation\n- Have the ICS20 precompile enabled\n- Have not upgraded to **v0.6.0** or applied the mitigation\n\nChains that have upgraded to **v0.6.0** or have disabled the ICS20 precompile are **not vulnerable to this issue**.\n\nIf you are unsure whether your chain is affected, please contact:\n\n**[security@cosmoslabs.io](mailto:security@cosmoslabs.io)**\n\n---\n\n## Timeline\n\n**July 2024**\n\nThe code containing the vulnerability was introduced upstream.\n\n**January 21, 2026**\n\nA network running the affected implementation experienced an exploit. The incident resulted in an estimated loss of approximately **$7M** on that network.\n\n**January 21, 2026**\n\nCosmos Labs was notified of the potential vulnerability and began investigating.\n\n**January 21\u201322, 2026**\n\nThe issue was reproduced and an initial mitigation was identified.\n\n**Late January 2026**\n\nRoot cause analysis was conducted and a long-term fix was developed.\n\n**Early February 2026**\n\nThe fix was validated internally and shared privately with affected ecosystem teams for review and testing.\n\n**Mid February 2026**\n\nPatches and mitigation guidance were distributed to chains running affected code.\n\n**March 2026**\n\nThe permanent fix was released publicly as part of **v0.6.0**.\n\n---\n\n## Acknowledgements\n\nWe would like to thank the teams and security partners who collaborated with us during the investigation and remediation process, including contributors from:\n\n- Saga\n- B-Harvest\n- Mantra\n- Zellic\n- Sherlock\n\nTheir collaboration and responsiveness helped accelerate investigation, validation of the fix, and coordinated mitigation across affected chains.\n\n---\n\n## Strengthening Security Processes\n\nFollowing this incident, Cosmos Labs is implementing several improvements to further strengthen the security of the Cosmos EVM stack, including:\n\n- Expanded fuzz testing focused on complex execution paths\n- Additional auditing of state management logic across EVM integrations\n- Improvements to testing frameworks for precompile functionality\n- Continued collaboration with ecosystem security partners\n- Increased our bug bounty payouts for our [security program](https://hackerone.com/cosmos)\n\nThese improvements are designed to reduce the likelihood of similar issues and ensure that teams building on the Cosmos stack can continue to rely on secure and well-tested infrastructure.\n\n---\n\n## Disclosure and Coordination\n\nCosmos Labs coordinated with ecosystem partners and affected teams to investigate the issue, validate mitigations, and distribute the permanent fix prior to public disclosure.\n\nWe appreciate the collaboration of ecosystem teams who assisted with investigation, validation, and responsible remediation of this issue.\n\n---\n\n## Responsible Disclosure\n\nCosmos Labs encourages responsible disclosure of potential vulnerabilities.\n\nSecurity researchers who discover a potential issue are encouraged to report it privately so it can be investigated and addressed responsibly.\n\nReports can be submitted to:\n\n**[security@cosmoslabs.io](mailto:security@cosmoslabs.io)**\n\nInformation about Cosmos Labs security programs and responsible disclosure practices, including bug bounty opportunities, will be made available through Cosmos Labs security channels, which can be signed up for [here](https://docs.google.com/forms/d/1Ae6ruTAw9zRoeN0xFxNbTfS-xCFdO68NGRsyFAeWHMc/edit).",
  "id": "GHSA-54gx-3cgr-7mfm",
  "modified": "2026-03-11T14:53:51Z",
  "published": "2026-03-11T14:53:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cosmos/evm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cosmos/evm/releases/tag/v0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cosmos EVM: incorrect state handling during nested EVM execution paths"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-26841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-16T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user to potentially enable information disclosure via local access.",
  "id": "GHSA-55cg-v6gq-m3wm",
  "modified": "2023-03-03T00:30:44Z",
  "published": "2023-02-16T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26841"
    },
    {
      "type": "WEB",
      "url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00677.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670",
      "CWE-698"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-06T12:15:08Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipulation of the argument url leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259497 was assigned to this vulnerability.",
  "id": "GHSA-574q-w5vp-7fm6",
  "modified": "2024-04-06T12:30:56Z",
  "published": "2024-04-06T12:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3376"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sospiro014/zday1/blob/main/Execution_After_Redirect.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.259497"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.259497"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.311154"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-27808"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-16T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.",
  "id": "GHSA-59jp-fjj9-mp2m",
  "modified": "2023-03-06T21:30:19Z",
  "published": "2023-02-16T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27808"
    },
    {
      "type": "WEB",
      "url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00761.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-20T13:15:07Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator.",
  "id": "GHSA-5fqf-3hpp-7g3x",
  "modified": "2024-04-04T03:36:55Z",
  "published": "2023-04-20T15:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29609"
    },
    {
      "type": "WEB",
      "url": "https://wiki.onosproject.org/display/ONOS/Intent+Framework"
    },
    {
      "type": "WEB",
      "url": "https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-07T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).",
  "id": "GHSA-5g37-xx8q-6w6x",
  "modified": "2024-02-15T21:31:25Z",
  "published": "2022-05-24T17:38:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3011"
    },
    {
      "type": "WEB",
      "url": "https://ninjalab.io/a-side-journey-to-titan"
    },
    {
      "type": "WEB",
      "url": "https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-98051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:34Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times\n\nThe loop initialised next_index from intf-\u003etx_spb_index on every\niteration, so incr_ring() always produced the same result and only\none slot was ever tested.  Move the initialisation before the loop\nso each iteration advances next_index and the function correctly\nchecks that cnt consecutive descriptor slots are available before\nallowing a new transmission.",
  "id": "GHSA-5g7r-gvc6-8wjf",
  "modified": "2026-10-06T15:31:27Z",
  "published": "2026-09-25T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98051"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0c5cf62e72d7a666ee4da757e122dc1600df1ecc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5df7ecd302488287665ab9767bacba7ed7e2842f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/990df1ba4d0805d1e7f6148c364febd2ab618766"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a8bddab54aa68b407f12294acb05bd552fb6a492"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7f7a16dd46ace4e221336a184c7806f7de19547"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-36277"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.",
  "id": "GHSA-5h62-2v5q-2mpg",
  "modified": "2022-05-24T17:44:15Z",
  "published": "2022-05-24T17:44:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36277"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DanBloomberg/leptonica/pull/499"
    },
    {
      "type": "WEB",
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21997"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00037.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQUEA2X6UTH4DMYCMZAWE2QQLN5YANUA"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RD5AIWHWE334HGYZJR2U3I3JYKSSO2LW"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202107-53"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mojocn/base64Captcha"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-45292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-12T18:09:52Z",
    "nvd_published_at": "2023-12-11T22:15:06Z",
    "severity": "MODERATE"
  },
  "details": "When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.",
  "id": "GHSA-5mmw-p5qv-w3x5",
  "modified": "2023-12-14T22:03:11Z",
  "published": "2023-12-12T00:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45292"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mojocn/base64Captcha/issues/120"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mojocn/base64Captcha"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2023-2386"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Always incorrect control flow in github.com/mojocn/base64Captcha"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-40396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-12T20:16:19Z",
    "severity": "MODERATE"
  },
  "details": "Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.",
  "id": "GHSA-5pmq-jgg5-3j6q",
  "modified": "2026-04-12T21:30:19Z",
  "published": "2026-04-12T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40396"
    },
    {
      "type": "WEB",
      "url": "https://github.com/varnish/varnish/issues/15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}