Security
فارسی
All products

github.com/cometbft/cometbft

Go · Package
12 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
CometBFT PeerState JSON serialization deadlockCVE-2023-34450 · GHSA-MVJ3-QRQH-CJVRVersion ranges need review. github.com/cometbft/cometbft Go Medium Fix reported
CometBFT may duplicate transactions in the mempool's data structuresCVE-2023-34451 · GHSA-W24W-WP77-QFFMVersion ranges need review. github.com/cometbft/cometbft Go High Fix reported
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid dataGHSA-P7MV-53F2-4CWJ · GO-2024-3259Version ranges need review. github.com/cometbft/cometbft Go High Fix reported
ASA-2024-004: Default configuration param for Evidence may limit window of validityGHSA-555P-M4V6-CQXV github.com/cometbft/cometbft Go Low No fix reported
CometBFT allows a malicious peer to make node stuck in blocksyncCVE-2025-24371 · GHSA-22QQ-3XWM-R5X4Version ranges need review. github.com/cometbft/cometbft Go Medium Fix reported
CometBFT has inconsistencies between how commit signatures are verified and how block time is derivedGHSA-C32P-WCQJ-J677 · GO-2026-4361Version ranges need review. github.com/cometbft/cometbft Go High Fix reported
CometBFT's invalid BitArray handling can lead to network haltGHSA-HRHF-2VCR-GHCH · GO-2025-4025Version ranges need review. github.com/cometbft/cometbft Go High Fix reported
CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block partsGHSA-R3R4-G7HQ-PQ4F · GO-2025-3443Version ranges need review. github.com/cometbft/cometbft Go High Fix reported
CometBFT's state syncing validator from malicious node may lead to a chain splitGHSA-G5XX-C4HV-9CCC · GO-2024-3112Version ranges need review. github.com/cometbft/cometbft/lightgithub.com/cometbft/cometbft Go Low Fix reported
CometBFT is unstability during blocksync when syncing from malicious peerGHSA-HG58-RF2H-6RR7 · GO-2024-2951Version ranges need review. github.com/cometbft/cometbft Go Medium Fix reported
Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbftGHSA-QR8R-M495-7HC4 · GO-2024-2471Version ranges need review. github.com/cometbft/cometbft Go High Fix reported
CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participationGHSA-HQ58-P9MV-338C github.com/cometbft/cometbft Go Low Fix reported