| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cometbft/cometbft | ≥ 0.37.0, < 0.37.7≥ 0.38.0, < 0.38.8 | 0.37.70.38.8 |
A malicious peer can cause a syncing node to panic during blocksync. The syncing node may enter into a catastrophic invalid syncing state or get stuck in blocksync mode, never switching to consensus. Nodes that are vulnerable to this state may experience a Denial of Service condition in which syncing will not work as expected when joining a network as a client.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free