{"action":"Upgrade github.com/cometbft/cometbft to 0.37.18 or later.","affected":[{"fixed":"0.37.18","introduced":"0"},{"fixed":"0.38.21","introduced":"0.38.0-alpha.1"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.37.18","0.38.21"],"ghsa_id":"GHSA-c32p-wcqj-j677","id":"tcs_01M5KGDCE9S8K0HYD5F8GMV3N5","modified_at":"2026-02-25T20:15:11Z","published_at":"2026-02-19T17:28:55Z","references":["https://osv.dev/vulnerability/GO-2026-4361","https://github.com/cometbft/cometbft/security/advisories/GHSA-c32p-wcqj-j677","https://github.com/cometbft/cometbft/commit/bf8274fcdbcab2bc652660ae627196a90a6efb97","https://github.com/cometbft/cometbft/releases/tag/v0.37.18","https://github.com/cometbft/cometbft/releases/tag/v0.38.21"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4361","url":"https://osv.dev/vulnerability/GO-2026-4361"}],"summary":"Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft"}