CVE-2021-41135

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includes a user-defined expiration time for when the authorization grant expires. In Grant.ValidateBasic(), that time is compared to the node’s local clock time. Any chain running an affected version of the SDK with the authz module enabled could be halted by anyone with the ability to send transactions on that chain. Recovery would require applying the patch and rolling back the latest block. Users are advised to update to version 0.44.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411363.7Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP heade CVE-2021-411378.8Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerabil CVE-2021-411385.3Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a la CVE-2021-411396.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Track CVE-2021-411405.3Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactio CVE-2021-411417.5PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP CVE-2021-411425.4Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site sc CVE-2021-411437.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could e CVE-2021-411448.8OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to exec CVE-2021-411457.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2021-411468.8qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for quteb CVE-2021-411477.2Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.9