{"action":"Upgrade github.com/cometbft/cometbft to 0.38.15 or later.","affected":[{"fixed":"0.38.15","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.38.15"],"ghsa_id":"GHSA-p7mv-53f2-4cwj","id":"tcs_01M5KFH3SSJWSBV0XEXJ1SE3F0","modified_at":"2026-09-02T22:15:05.253906684Z","published_at":"2024-11-06T15:33:55Z","references":["https://osv.dev/vulnerability/GHSA-p7mv-53f2-4cwj","https://github.com/cometbft/cometbft/security/advisories/GHSA-p7mv-53f2-4cwj","https://github.com/cometbft/cometbft/commit/17d3bb66664cab6d6798c17e27198e15bbac1905","https://docs.cometbft.com/v0.38/spec/abci/abci++_basic_concepts","https://github.com/cometbft/cometbft","https://github.com/cometbft/cometbft/releases/tag/v0.38.15","https://nrdax.com/techniques/NRDAX-T0211","https://pkg.go.dev/vuln/GO-2024-3259"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-p7mv-53f2-4cwj","url":"https://osv.dev/vulnerability/GHSA-p7mv-53f2-4cwj"}],"summary":"CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data"}