Go/github.com/cometbft/cometbft: high
CometBFT's invalid BitArray handling can lead to network halt
Action: Upgrade github.com/cometbft/cometbft to 0.37.16 or later.
go get github.com/cometbft/cometbft@v0.37.16go get github.com/cometbft/cometbft@v0.38.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.37.16 | - |
| 0.38.0-alpha.1 | 0.38.19 | - |
Fixed versions
| 0.37.16 | 0.38.19 |
Sources
- osv: GHSA-hrhf-2vcr-ghch
- https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch
- https://github.com/cometbft/cometbft/commit/be5677c3e58f998b7f67bb6186dd2c9b81a041a1
- https://github.com/cometbft/cometbft/commit/dcb1f265b59477be40804f7ccdc4fb30612d6a4f
- https://github.com/cometbft/cometbft
- https://github.com/cometbft/cometbft/releases/tag/v0.37.16
- https://github.com/cometbft/cometbft/releases/tag/v0.38.19
published · modified · JSON