CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

概要

参考情報

• cometbft/cometbft security advisory · ADVISORY
• docs.cometbft.com/v0.38/spec/abci/abci++_basic_concepts · WEB
• cometbft/cometbft release v0.38.15 · WEB
• cometbft/cometbft commit 17d3bb6 · FIX

github.com/cometbft/cometbft のその他の脆弱性

• GO-2026-4361Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft
• GHSA-c32p-wcqj-j677高CometBFT has inconsistencies between how commit signatures are verified and how block time is derived
• GO-2025-4025CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
• GHSA-hrhf-2vcr-ghch高CometBFT's invalid BitArray handling can lead to network halt
• GO-2025-3443CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft