Go/github.com/cometbft/cometbft: low
CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation
Action: Upgrade github.com/cometbft/cometbft to 0.34.32 or later.
go get github.com/cometbft/cometbft@v0.38.6go get github.com/cometbft/cometbft@v0.37.5go get github.com/cometbft/cometbft@v0.34.32Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.38.0 | 0.38.6 | - |
| 0.37.0 | 0.37.5 | - |
| 0 | 0.34.32 | - |
Fixed versions
| 0.38.6 | 0.37.5 | 0.34.32 |
Sources
- osv: GHSA-hq58-p9mv-338c
- https://github.com/cometbft/cometbft/security/advisories/GHSA-hq58-p9mv-338c
- https://github.com/cometbft/cometbft/pull/1405
- https://github.com/cometbft/cometbft/commit/0401888bbf6a7148ed039c7cca7380644496c78d
- https://github.com/cometbft/cometbft/commit/1f48ff904cc0e1c723c05c72afba86bf0a1ea028
- https://github.com/cometbft/cometbft/commit/28ad4d2230134045e2f5ce9fdab6673e276f2579
- https://github.com/cometbft/cometbft/commit/fce9dd6e67ee81efe0f4e7442a09016bdae5cfcf
- https://docs.cometbft.com/v0.34/spec/abci/apps#blockparamsmaxbytes
- https://docs.cometbft.com/v0.37/spec/abci/abci++_app_requirements#blockparamsmaxbytes
- https://docs.cometbft.com/v0.38/spec/abci/abci++_app_requirements#blockparamsmaxbytes
- https://github.com/cometbft/cometbft
published · modified · JSON