| GO-2026-4361 | — | Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft | 19/02/2026 |
| GHSA-c32p-wcqj-j677 | CAO | CometBFT has inconsistencies between how commit signatures are verified and how block time is derived | 23/01/2026 |
| GO-2025-4025 | — | CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft | 18/11/2025 |
| GHSA-hrhf-2vcr-ghch | CAO | CometBFT's invalid BitArray handling can lead to network halt | 14/10/2025 |
| GO-2025-3443 | — | CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft | 04/02/2025 |
| CVE-2025-24371 | CAO7.1 | CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only | 03/02/2025 |
| GHSA-r3r4-g7hq-pq4f | CAO | CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts | 03/02/2025 |
| GO-2024-3259 | — | CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft | 20/11/2024 |
| GHSA-p7mv-53f2-4cwj | CAO | CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data | 06/11/2024 |
| GO-2024-3112 | — | CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft | 13/09/2024 |
| GHSA-g5xx-c4hv-9ccc | THẤP4.7 | CometBFT's state syncing validator from malicious node may lead to a chain split | 03/09/2024 |
| GO-2024-2951 | — | Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft | 02/07/2024 |
| GHSA-hg58-rf2h-6rr7 | TRUNG BÌNH | CometBFT is unstability during blocksync when syncing from malicious peer | 28/06/2024 |
| GHSA-555p-m4v6-cqxv | THẤP | ASA-2024-004: Default configuration param for Evidence may limit window of validity | 28/02/2024 |
| GO-2024-2471 | — | Chain halt panic in github.com/cometbft/cometbft | 23/01/2024 |
| GHSA-qr8r-m495-7hc4 | CAO | Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft | 19/01/2024 |
| GHSA-hq58-p9mv-338c | THẤP | CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation | 29/09/2023 |
| CVE-2023-34451 | CAO8.2 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. The mempool maintains two data structures to keep track of outstanding transactions: a list and a map.
These two data structures are supposed to be in sync all the time in the sense that the | 03/07/2023 |
| CVE-2023-34450 | TRUNG BÌNH5.3 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made in versions 0.34.28 and 0.37.1 to the way struct `PeerState` is serialized to JSON introduced a deadlock when new function MarshallJSON is called. This function | 03/07/2023 |