blocksync

Oct 16, 2025 GO-2025-3442

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

Oct 14, 2025 GO-2025-3442

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

Sep 18, 2025 GO-2025-3442

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

Jan 23, 2026 GO-2025-3442

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

Dec 12, 2025 GO-2025-3442 +1 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Oct 14, 2025 GO-2025-3442 +1 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jul 3, 2025 GO-2025-3442 +2 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Feb 3, 2025 GO-2025-3442 +2 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Dec 20, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

type BlockPool

+ func (pool *BlockPool) IsPeerBanned(peerID p2p.ID) bool

Nov 6, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Nov 6, 2024 GO-2024-3259 +5 more

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Oct 25, 2024 GO-2024-3259 +5 more

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Sep 3, 2024 GO-2024-3259 +5 more

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Aug 12, 2024 GO-2024-3112 +6 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jul 15, 2024 GO-2024-3112 +6 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

type Reactor

+ func NewReactorWithAddr(state sm.State, blockExec *sm.BlockExecutor, store *store.BlockStore, ...) *Reactor

Jul 1, 2024 GO-2024-3112 +6 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jun 27, 2024 GO-2024-3112 +6 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Apr 27, 2024 GO-2024-2951 +7 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Mar 13, 2024 GO-2024-2951 +7 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jan 24, 2024 GO-2024-2951 +7 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jan 22, 2024

retracted

GO-2024-2951 +7 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jan 18, 2024

retracted

GO-2024-2951 +7 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Nov 27, 2023

retracted

GO-2024-2471 +8 more

  GO-2024-2471: Chain halt panic in github.com/cometbft/cometbft

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Nov 17, 2023

retracted

GO-2024-2471 +8 more

  GO-2024-2471: Chain halt panic in github.com/cometbft/cometbft

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Sep 12, 2023

retracted

GO-2024-2471 +8 more

  GO-2024-2471: Chain halt panic in github.com/cometbft/cometbft

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2024-3259: CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

+ const MetricsSubsystem

+ var ErrNilMessage = errors.New("message cannot be nil")

+ type ErrInvalidBase struct

+ Base int64

+ Reason string

+ func (e ErrInvalidBase) Error() string

+ type ErrInvalidHeight struct

+ Height int64

+ Reason string

+ func (e ErrInvalidHeight) Error() string

+ type ErrReactorValidation struct

+ Err error

+ func (e ErrReactorValidation) Error() string

+ func (e ErrReactorValidation) Unwrap() error

+ type ErrUnknownMessageType struct

+ Msg proto.Message

+ func (e ErrUnknownMessageType) Error() string

+ type Metrics struct

+ BlockSizeBytes metrics.Gauge

+ LatestBlockHeight metrics.Gauge

+ NumTxs metrics.Gauge

+ Syncing metrics.Gauge

+ TotalTxs metrics.Gauge

+ func NopMetrics() *Metrics

+ func PrometheusMetrics(namespace string, labelsAndValues ...string) *Metrics

type Reactor

+ func (bcR *Reactor) Receive(e p2p.Envelope)

Jul 14, 2023 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jun 26, 2023 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jun 5, 2023 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

May 17, 2023 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Mar 29, 2023 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jan 23, 2026 GO-2025-3442 +2 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

Dec 12, 2025 GO-2025-3442 +3 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Oct 14, 2025 GO-2025-3442 +3 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Feb 3, 2025 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Dec 20, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Oct 31, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Oct 25, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Sep 3, 2024 GO-2025-3442 +4 more

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Aug 12, 2024 GO-2024-3112 +5 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jul 15, 2024 GO-2024-3112 +5 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

type Reactor

+ func NewReactorWithOfflineStateSyncAndAddr(state sm.State, blockExec *sm.BlockExecutor, store *store.BlockStore, ...) *Reactor

Jul 1, 2024 GO-2024-3112 +5 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Jun 27, 2024 GO-2024-3112 +5 more

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Apr 27, 2024 GO-2024-2951 +6 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Mar 13, 2024 GO-2024-2951 +6 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

type BlockPool

+ func (pool *BlockPool) Height() int64

+ func (pool *BlockPool) RedoRequestFrom(height int64, peerID p2p.ID)

+ func (pool *BlockPool) RemovePeerAndRedoAllPeerRequests(height int64) p2p.ID

Nov 27, 2023 GO-2024-2951 +6 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Nov 17, 2023 GO-2024-2951 +6 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

type Reactor

+ func NewReactorWithOfflineStateSync(state sm.State, blockExec *sm.BlockExecutor, store *store.BlockStore, ...) *Reactor

Jun 14, 2023 GO-2024-2951 +6 more

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Apr 26, 2023 GO-2023-1882 +8 more

  GO-2023-1882: Deadlock in github.com/cometbft/cometbft/consensus

  GO-2023-1883: Denial of service via OOM in github.com/cometbft/cometbft

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Mar 6, 2023 GO-2023-1883 +7 more

  GO-2023-1883: Denial of service via OOM in github.com/cometbft/cometbft

  GO-2024-2951: Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft

  GO-2024-3112: CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Changes in this version

+ const BlockResponseMessageFieldKeySize

+ const BlockResponseMessagePrefixSize

+ const BlocksyncChannel

+ const MaxMsgSize

+ func ValidateMsg(pb proto.Message) error

+ type BlockPool struct

+ func NewBlockPool(start int64, requestsCh chan<- BlockRequest, errorsCh chan<- peerError) *BlockPool

+ func (pool *BlockPool) AddBlock(peerID p2p.ID, block *types.Block, blockSize int)

+ func (pool *BlockPool) GetStatus() (height int64, numPending int32, lenRequesters int)

+ func (pool *BlockPool) IsCaughtUp() bool

+ func (pool *BlockPool) MaxPeerHeight() int64

+ func (pool *BlockPool) OnStart() error

+ func (pool *BlockPool) PeekTwoBlocks() (first *types.Block, second *types.Block)

+ func (pool *BlockPool) PopRequest()

+ func (pool *BlockPool) RedoRequest(height int64) p2p.ID

+ func (pool *BlockPool) RemovePeer(peerID p2p.ID)

+ func (pool *BlockPool) SetPeerRange(peerID p2p.ID, base int64, height int64)

+ type BlockRequest struct

+ Height int64

+ PeerID p2p.ID

+ type Reactor struct

+ func NewReactor(state sm.State, blockExec *sm.BlockExecutor, store *store.BlockStore, ...) *Reactor

+ func (bcR *Reactor) AddPeer(peer p2p.Peer)

+ func (bcR *Reactor) BroadcastStatusRequest()

+ func (bcR *Reactor) GetChannels() []*p2p.ChannelDescriptor

+ func (bcR *Reactor) OnStart() error

+ func (bcR *Reactor) OnStop()

+ func (bcR *Reactor) ReceiveEnvelope(e p2p.Envelope)

+ func (bcR *Reactor) RemovePeer(peer p2p.Peer, reason interface{})

+ func (bcR *Reactor) SetLogger(l log.Logger)

+ func (bcR *Reactor) SwitchToBlockSync(state sm.State) error

Mar 1, 2023 GO-2023-1883 +5 more

  GO-2023-1883: Denial of service via OOM in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Feb 28, 2023 GO-2023-1883 +5 more

  GO-2023-1883: Denial of service via OOM in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft

Feb 21, 2023 GO-2023-1883 +5 more

  GO-2023-1883: Denial of service via OOM in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3442: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft

  GO-2025-3443: CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

  GO-2025-4025: CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

  GO-2026-4361: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft