{"action":"Upgrade github.com/cometbft/cometbft to 0.38.17 or later.","affected":[{"fixed":"1.0.1","introduced":"1.0.0-alpha.1"},{"fixed":"0.38.17","introduced":"0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.0.1","0.38.17"],"ghsa_id":"GHSA-r3r4-g7hq-pq4f","id":"tcs_01M5KFKZCV61ZZF9SBEBY7BJZ3","modified_at":"2025-02-05T16:34:57Z","published_at":"2025-02-03T16:48:59Z","references":["https://osv.dev/vulnerability/GHSA-r3r4-g7hq-pq4f","https://github.com/cometbft/cometbft/security/advisories/GHSA-r3r4-g7hq-pq4f","https://github.com/cometbft/cometbft/commit/415c0da223bb7694608913f725fa45bd7a7a46bf","https://github.com/cometbft/cometbft/commit/f943aabc7b9201ea1089ff3381479929435ce424","https://github.com/cometbft/cometbft","https://pkg.go.dev/vuln/GO-2025-3443"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-r3r4-g7hq-pq4f","url":"https://osv.dev/vulnerability/GHSA-r3r4-g7hq-pq4f"}],"summary":"CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts"}