{"action":"Upgrade github.com/cometbft/cometbft to 0.37.7 or later.","affected":[{"fixed":"0.37.7","introduced":"0.37.0"},{"fixed":"0.38.8","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.37.7","0.38.8"],"ghsa_id":"GHSA-hg58-rf2h-6rr7","id":"tcs_01M5KG414B1QA4PT1TBDR01DA2","modified_at":"2024-07-02T18:12:57.188147Z","published_at":"2024-07-02T17:39:03Z","references":["https://osv.dev/vulnerability/GO-2024-2951","https://github.com/cometbft/cometbft/security/advisories/GHSA-hg58-rf2h-6rr7","https://github.com/cometbft/cometbft/commit/07866e11139127e415bd0339ac377b6e6a845533","https://github.com/cometbft/cometbft/commit/8ba2e4f52d5e626e019501ba6420cc86d5de7857"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2951","url":"https://osv.dev/vulnerability/GO-2024-2951"}],"summary":"Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft"}