Vulnerability-Lookup

CVE-2025-24371 (GCVE-0-2025-24371)

Vulnerability from cvelistv5 – Published: 2025-02-03 21:20 – Updated: 2025-02-04 19:16

Title

Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft

Summary

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-04 19:15 UTC

CWE

CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/cometbft/cometbft/security/adv…	x_refsource_CONFIRM
https://github.com/cometbft/cometbft/releases/tag…	x_refsource_MISC
https://github.com/cometbft/cometbft/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
cometbft	cometbft	Affected: < 0.38.17 Affected: = 1.0.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T19:15:05.677855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-04T19:16:21.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cometbft",
          "vendor": "cometbft",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.38.17"
            },
            {
              "status": "affected",
              "version": "= 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-03T21:20:56.024Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4"
        },
        {
          "name": "https://github.com/cometbft/cometbft/releases/tag/v0.38.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cometbft/cometbft/releases/tag/v0.38.17"
        },
        {
          "name": "https://github.com/cometbft/cometbft/releases/tag/v1.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cometbft/cometbft/releases/tag/v1.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-22qq-3xwm-r5x4",
        "discovery": "UNKNOWN"
      },
      "title": "Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-24371",
    "datePublished": "2025-02-03T21:20:56.024Z",
    "dateReserved": "2025-01-20T15:18:26.991Z",
    "dateUpdated": "2025-02-04T19:16:21.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-24371",
      "date": "2026-09-17",
      "epss": "0.00464",
      "percentile": "0.39256"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-24371\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-02-03T22:15:28.460\",\"lastModified\":\"2026-06-17T08:58:55.260\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.\"},{\"lang\":\"es\",\"value\":\"CometBFT es un motor de replicaci\u00f3n de m\u00e1quina de estados determinista, tolerante a fallas bizantinas y distribuido. En el protocolo `blocksync`, los pares env\u00edan sus alturas `base` y `latest` cuando se conectan a un nuevo nodo (`A`), que se sincroniza con la punta de una red. `base` act\u00faa como una base inferior e informa a `A` que el par solo tiene bloques que comienzan con la altura `base`. La altura `latest` informa a `A` sobre el \u00faltimo bloque en una red. Normalmente, los nodos solo informar\u00edan alturas crecientes. Si `B` no proporciona el \u00faltimo bloque, `B` se elimina y la altura `latest` (altura objetivo) se recalcula en funci\u00f3n de las alturas `latest` de otros nodos. Sin embargo, el c\u00f3digo existente no verifica el caso en el que `B` primero informa la `latest` altura `X` e inmediatamente despu\u00e9s la altura `Y`, donde `X \u0026gt; Y`. `A` intentar\u00e1 alcanzar el 2000 indefinidamente. Esta condici\u00f3n requiere la introducci\u00f3n de c\u00f3digo malicioso en el nodo completo que primero informa una altura `latest` inexistente, luego informa una altura `latest` menor y nodos que se sincronizan mediante el protocolo `blocksync`. Este problema se ha corregido en las versiones 1.0.1 y 0.38.17 y se recomienda a todos los usuarios que actualicen. Los operadores pueden intentar prohibir el acceso de pares maliciosos a la red como workaround.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"cometbft\",\"product\":\"cometbft\",\"versions\":[{\"version\":\"\u003c 0.38.17\",\"status\":\"affected\"},{\"version\":\"= 1.0.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-04T19:15:05.677855Z\",\"id\":\"CVE-2025-24371\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-703\"}]}],\"references\":[{\"url\":\"https://github.com/cometbft/cometbft/releases/tag/v0.38.17\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/cometbft/cometbft/releases/tag/v1.0.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:16:35+00:00",
      "cve": "CVE-2025-24371",
      "id": "CVE-2025-24371",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24371.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-17T13:14:11Z",
      "cve": "CVE-2025-24371",
      "id": "CVE-2025-24371",
      "initial_release_date": "2025-02-06T03:48:04Z",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-24371",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-24371.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-24371\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T19:15:05.677855Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T19:16:10.482Z\"}}], \"cna\": {\"title\": \"Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft\", \"source\": {\"advisory\": \"GHSA-22qq-3xwm-r5x4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"cometbft\", \"product\": \"cometbft\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.38.17\"}, {\"status\": \"affected\", \"version\": \"= 1.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4\", \"name\": \"https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/cometbft/cometbft/releases/tag/v0.38.17\", \"name\": \"https://github.com/cometbft/cometbft/releases/tag/v0.38.17\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/cometbft/cometbft/releases/tag/v1.0.1\", \"name\": \"https://github.com/cometbft/cometbft/releases/tag/v1.0.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-703\", \"description\": \"CWE-703: Improper Check or Handling of Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-02-03T21:20:56.024Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-24371\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-04T19:16:21.174Z\", \"dateReserved\": \"2025-01-20T15:18:26.991Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-02-03T21:20:56.024Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-24371

Vulnerability from fkie_nvd - Published: 2025-02-03 22:15 - Updated: 2026-06-17 08:58

Severity

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/cometbft/cometbft/releases/tag/v0.38.17
	security-advisories@github.com	https://github.com/cometbft/cometbft/releases/tag/v1.0.1
	security-advisories@github.com	https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cometbft",
          "vendor": "cometbft",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.38.17"
            },
            {
              "status": "affected",
              "version": "= 1.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround."
    },
    {
      "lang": "es",
      "value": "CometBFT es un motor de replicaci\u00f3n de m\u00e1quina de estados determinista, tolerante a fallas bizantinas y distribuido. En el protocolo `blocksync`, los pares env\u00edan sus alturas `base` y `latest` cuando se conectan a un nuevo nodo (`A`), que se sincroniza con la punta de una red. `base` act\u00faa como una base inferior e informa a `A` que el par solo tiene bloques que comienzan con la altura `base`. La altura `latest` informa a `A` sobre el \u00faltimo bloque en una red. Normalmente, los nodos solo informar\u00edan alturas crecientes. Si `B` no proporciona el \u00faltimo bloque, `B` se elimina y la altura `latest` (altura objetivo) se recalcula en funci\u00f3n de las alturas `latest` de otros nodos. Sin embargo, el c\u00f3digo existente no verifica el caso en el que `B` primero informa la `latest` altura `X` e inmediatamente despu\u00e9s la altura `Y`, donde `X \u0026gt; Y`. `A` intentar\u00e1 alcanzar el 2000 indefinidamente. Esta condici\u00f3n requiere la introducci\u00f3n de c\u00f3digo malicioso en el nodo completo que primero informa una altura `latest` inexistente, luego informa una altura `latest` menor y nodos que se sincronizan mediante el protocolo `blocksync`. Este problema se ha corregido en las versiones 1.0.1 y 0.38.17 y se recomienda a todos los usuarios que actualicen. Los operadores pueden intentar prohibir el acceso de pares maliciosos a la red como workaround."
    }
  ],
  "id": "CVE-2025-24371",
  "lastModified": "2026-06-17T08:58:55.260",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24371",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-04T19:15:05.677855Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-03T22:15:28.460",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cometbft/cometbft/releases/tag/v0.38.17"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cometbft/cometbft/releases/tag/v1.0.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-703"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-22QQ-3XWM-R5X4

Vulnerability from github – Published: 2025-02-03 15:55 – Updated: 2026-03-09 20:46

Summary

CometBFT allows a malicious peer to make node stuck in blocksync

Details

Name: ASA-2025-001: Malicious peer can disrupt node's ability to sync via blocksync Component: CometBFT [OUTDATED] Criticality: Medium (Considerable Impact; Possible Likelihood per ACMv1.2) Update of Criticality on 2026-03-06: We've made a mistake and over-rated the criticality of this bug in our initial triage. We have calibrated our vulnerability rating internally and updated the criticality of this bug to be Informational (Negligible Impact, Possible Likelihood) Affected versions: <= v0.38.16, v1.0.0 Affected users: Validators, Full nodes

Impact

A malicious peer may be able to interfere with a node's ability to sync blocks with peers via the blocksync mechanism.

In the blocksync protocol peers send their base and latest heights when they connect to a new node (A), which is syncing to the tip of a network. base acts as a lower ground and informs A that the peer only has blocks starting from height base. latest height informs A about the latest block in a network. Normally, nodes would only report increasing heights:

B: {base: 100, latest: 1000}
B: {base: 100, latest: 1001}
B: {base: 100, latest: 1002}
...

If B fails to provide the latest block, B is removed and the latest height (target height) is recalculated based on other nodes latest heights.

The existing code hovewer doesn't check for the case where B first reports latest height X and immediately after height Y, where X > Y. For example:

B: {base: 100, latest: 2000}
B: {base: 100, latest: 1001}
B: {base: 100, latest: 1002}
...

A will be trying to catch up to 2000 indefinitely. Even if B disconnects, the latest height (target height) won't be recalculated because A "doesn't know where 2000" came from per see.

Impact Qualification

This condition requires the introduction of malicious code in the full node first reporting a non-existing latest height, then reporting lower latest height and nodes which are syncing using blocksync protocol.

Patches

The new CometBFT releases v1.0.1 and v0.38.17 fix this issue.

Unreleased code in the main is patched as well.

Workarounds

When the operator notices blocksync is stuck, they can identify the peer from which that message with "invalid" height was received. This may require increasing the logging level of the blocksync module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.

References

If you have questions about Interchain security efforts, please reach out to our official communication channel at security@interchain.io. For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.

A Github Security Advisory for this issue is available in the CometBFT repository. For more information about CometBFT, see https://docs.cometbft.com/.

EDIT:

Please notice that this has been updated to be informational severity. This can be avoided by ensuring that one is not connected to a malicious peer during blocksync.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cometbft/cometbft"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-alpha.1"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cometbft/cometbft"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.38.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-24371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-703"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-03T15:55:28Z",
    "nvd_published_at": "2025-02-03T22:15:28Z",
    "severity": "MODERATE"
  },
  "details": "Name: ASA-2025-001: Malicious peer can disrupt node\u0027s ability to sync via blocksync\nComponent: CometBFT\n[OUTDATED] Criticality: Medium (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\n**Update of Criticality on 2026-03-06**: We\u0027ve made a mistake and over-rated the criticality of this bug in our initial triage. We have calibrated our vulnerability rating internally and updated the criticality of this bug to be Informational (Negligible Impact, Possible Likelihood)\nAffected versions: \u003c= v0.38.16, v1.0.0\nAffected users: Validators, Full nodes\n\n### Impact\n\nA malicious peer may be able to interfere with a node\u0027s ability to sync blocks with peers via the blocksync mechanism. \n\nIn the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights:\n\n```\nB: {base: 100, latest: 1000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\nIf `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights.\n\nThe existing code hovewer doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. For example:\n\n```\nB: {base: 100, latest: 2000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\n`A` will be trying to catch up to 2000 indefinitely. Even if `B` disconnects, the `latest` height (target height) won\u0027t be recalculated because `A` \"doesn\u0027t know where 2000\" came from per see.\n\n#### Impact Qualification\n\nThis condition requires the introduction of malicious code in the full node first reporting a non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol.\n\n### Patches\n\nThe new CometBFT releases [v1.0.1](https://github.com/cometbft/cometbft/releases/tag/v1.0.1) and [v0.38.17](https://github.com/cometbft/cometbft/releases/tag/v0.38.17) fix this issue.\n\nUnreleased code in the main is patched as well.\n\n### Workarounds\n\nWhen the operator notices `blocksync` is stuck, they can identify the peer from which that message with \"invalid\" height was received. This may require increasing the logging level of the `blocksync` module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.\n\n### References\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io).  For more information about the Interchain Foundation\u2019s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  \n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4). For more information about CometBFT, see https://docs.cometbft.com/.\n\nEDIT:\n\nPlease notice that this has been updated to be `informational` severity.  This can be avoided by ensuring that one is not connected to a malicious peer during blocksync.",
  "id": "GHSA-22qq-3xwm-r5x4",
  "modified": "2026-03-09T20:46:44Z",
  "published": "2025-02-03T15:55:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cometbft/cometbft"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cometbft/cometbft/releases/tag/v0.38.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cometbft/cometbft/releases/tag/v1.0.1"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3442"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CometBFT allows a malicious peer to make node stuck in blocksync"
}

OPENSUSE-SU-2025:14732-1

Vulnerability from csaf_opensuse - Published: 2025-02-05 00:00 - Updated: 2025-02-05 00:00

Summary

govulncheck-vulndb-0.0.20250204T220613-1.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2025-24371.

CVE-2025-24371

Recommended: 4 products

Open the full advisory

SUSE-SU-2025:0429-1

Vulnerability from csaf_suse - Published: 2025-02-11 14:12 - Updated: 2025-02-11 14:12

Summary

Security update for govulncheck-vulndb

Severity

Moderate

Scope

28 vulnerabilities in this advisory, including CVE-2025-24371.

CVE-2025-24371

Recommended: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-24371 (GCVE-0-2025-24371)

FKIE_CVE-2025-24371

GHSA-22QQ-3XWM-R5X4

Impact

Impact Qualification

Patches

Workarounds

References

OPENSUSE-SU-2025:14732-1

SUSE-SU-2025:0429-1

Tags

Sightings

Nomenclature

Related by attack behaviour