{"action":"Upgrade github.com/cometbft/cometbft to 0.38.17 or later.","affected":[{"fixed":"0.38.17","introduced":"0"},{"fixed":"1.0.1","introduced":"0"}],"component":"github.com/cometbft/cometbft","cve_ids":["CVE-2025-24371"],"ecosystem":"Go","epss":0.00464,"exploited":false,"fixed_versions":["0.38.17","1.0.1"],"ghsa_id":"GHSA-22qq-3xwm-r5x4","id":"tcs_01M5KG6YK87ET4K986WW9JTHJ4","modified_at":"2025-11-18T15:33:53Z","published_at":"2025-02-04T22:06:13Z","references":["https://osv.dev/vulnerability/GO-2025-3442","https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4","https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce","https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5","https://github.com/cometbft/cometbft/releases/tag/v0.38.17","https://github.com/cometbft/cometbft/releases/tag/v1.0.1"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GO-2025-3442","url":"https://osv.dev/vulnerability/GO-2025-3442"},{"source":"nvd","source_id":"CVE-2025-24371","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24371"}],"summary":"CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft"}