{"action":"Upgrade tendermint-light-client-verifier to 0.40.3 or later.","affected":[{"fixed":"0.40.3","introduced":"0"}],"component":"tendermint-light-client-verifier","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.40.3"],"ghsa_id":"GHSA-6jrf-4jv4-r9mw","id":"tcs_01M5KETQS41HYBXTT8B509V53S","modified_at":"2025-04-09T13:01:26Z","published_at":"2025-04-09T13:01:26Z","references":["https://osv.dev/vulnerability/GHSA-6jrf-4jv4-r9mw","https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-6jrf-4jv4-r9mw","https://github.com/informalsystems/tendermint-rs/commit/1aabcfe6a3c0678db22097543f7f7a662f0db34b","https://github.com/informalsystems/tendermint-rs"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-6jrf-4jv4-r9mw","url":"https://osv.dev/vulnerability/GHSA-6jrf-4jv4-r9mw"}],"summary":"tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators"}