CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/02/2025 |
| CVE-2025-24371 | 高危7.1 | CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only | 03/02/2025 |
| GHSA-r3r4-g7hq-pq4f | 高危 | CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts | 03/02/2025 |
| GO-2024-3259 | CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft | 20/11/2024 |
| GHSA-p7mv-53f2-4cwj | 高危 | CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data | 06/11/2024 |
| GO-2024-3112 | CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft | 13/09/2024 |
| GHSA-g5xx-c4hv-9ccc | 低危4.7 | CometBFT's state syncing validator from malicious node may lead to a chain split | 03/09/2024 |
| GO-2024-2951 | Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft | 02/07/2024 |
| GHSA-hg58-rf2h-6rr7 | 中危 | CometBFT is unstability during blocksync when syncing from malicious peer | 28/06/2024 |
| GHSA-555p-m4v6-cqxv | 低危 | ASA-2024-004: Default configuration param for Evidence may limit window of validity | 28/02/2024 |
| GO-2024-2471 | Chain halt panic in github.com/cometbft/cometbft | 23/01/2024 |
| GHSA-qr8r-m495-7hc4 | 高危 | Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft | 19/01/2024 |
| GHSA-hq58-p9mv-338c | 低危 | CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation | 29/09/2023 |
| CVE-2023-34451 | 高危8.2 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. The mempool maintains two data structures to keep track of outstanding transactions: a list and a map.
These two data structures are supposed to be in sync all the time in the sense that the | 03/07/2023 |
| CVE-2023-34450 | 中危5.3 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made in versions 0.34.28 and 0.37.1 to the way struct `PeerState` is serialized to JSON introduced a deadlock when new function MarshallJSON is called. This function | 03/07/2023 |