{"action":"Upgrade github.com/cometbft/cometbft to 0.37.18 or later.","affected":[{"fixed":"0.38.21","introduced":"0.38.0-alpha.1"},{"fixed":"0.37.18","introduced":"0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.38.21","0.37.18"],"ghsa_id":"GHSA-c32p-wcqj-j677","id":"tcs_01M5KF6GZ8N152V4CTDSQCXMMM","modified_at":"2026-02-28T05:13:47.205461Z","published_at":"2026-01-23T16:56:23Z","references":["https://osv.dev/vulnerability/GHSA-c32p-wcqj-j677","https://github.com/cometbft/cometbft/security/advisories/GHSA-c32p-wcqj-j677","https://github.com/cometbft/cometbft/commit/bf8274fcdbcab2bc652660ae627196a90a6efb97","https://github.com/cometbft/cometbft","https://github.com/cometbft/cometbft/releases/tag/v0.37.18","https://github.com/cometbft/cometbft/releases/tag/v0.38.21","https://pkg.go.dev/vuln/GO-2026-4361"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-c32p-wcqj-j677","url":"https://osv.dev/vulnerability/GHSA-c32p-wcqj-j677"}],"summary":"CometBFT has inconsistencies between how commit signatures are verified and how block time is derived"}