{"action":"Upgrade github.com/cometbft/cometbft to 0.38.17 or later.","affected":[{"fixed":"0.38.17","introduced":"0"},{"fixed":"1.0.1","introduced":"1.0.0-alpha.1"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.38.17","1.0.1"],"ghsa_id":"GHSA-r3r4-g7hq-pq4f","id":"tcs_01M5KG6YPJ7VD2PCK2A3BZND33","modified_at":"2025-04-01T21:50:18Z","published_at":"2025-02-04T22:06:13Z","references":["https://osv.dev/vulnerability/GO-2025-3443","https://github.com/cometbft/cometbft/security/advisories/GHSA-r3r4-g7hq-pq4f","https://github.com/cometbft/cometbft/commit/415c0da223bb7694608913f725fa45bd7a7a46bf","https://github.com/cometbft/cometbft/commit/f943aabc7b9201ea1089ff3381479929435ce424"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2025-3443","url":"https://osv.dev/vulnerability/GO-2025-3443"}],"summary":"CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft"}