{"action":"Upgrade github.com/cometbft/cometbft to 0.38.15 or later.","affected":[{"fixed":"0.38.15","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.38.15"],"ghsa_id":"GHSA-p7mv-53f2-4cwj","id":"tcs_01M5KG5ZG7WZV88JEVJ3EAW78H","modified_at":"2024-12-12T21:58:41Z","published_at":"2024-11-20T17:22:48Z","references":["https://osv.dev/vulnerability/GO-2024-3259","https://github.com/cometbft/cometbft/security/advisories/GHSA-p7mv-53f2-4cwj","https://docs.cometbft.com/v0.38/spec/abci/abci++_basic_concepts","https://github.com/cometbft/cometbft/releases/tag/v0.38.15","https://github.com/cometbft/cometbft/commit/17d3bb66664cab6d6798c17e27198e15bbac1905"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-3259","url":"https://osv.dev/vulnerability/GO-2024-3259"}],"summary":"CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft"}