{"schema_version":"1.7.3","id":"GO-2025-3442","published":"2025-02-04T22:06:13Z","modified":"2025-11-18T15:33:53Z","aliases":["CVE-2025-24371","GHSA-22qq-3xwm-r5x4"],"summary":"CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft","details":"CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft","affected":[{"package":{"name":"github.com/cometbft/cometbft","ecosystem":"Go","purl":"pkg:golang/github.com/cometbft/cometbft"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.38.17"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cometbft/cometbft/blocksync","symbols":["BlockPool.SetPeerRange","Reactor.Receive"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-3442.json"}},{"package":{"name":"github.com/cometbft/cometbft","ecosystem":"Go","purl":"pkg:golang/github.com/cometbft/cometbft"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cometbft/cometbft/internal/blocksync","symbols":["BlockPool.SetPeerRange","Reactor.Receive"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-3442.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4"},{"type":"FIX","url":"https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce"},{"type":"FIX","url":"https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5"},{"type":"WEB","url":"https://github.com/cometbft/cometbft/releases/tag/v0.38.17"},{"type":"WEB","url":"https://github.com/cometbft/cometbft/releases/tag/v1.0.1"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2025-3442"}}