GHSA-2fcv-qww3-9v6h Babylon's malformed vote extensions are not rejected
Adversarial validators can halt the blockchain by sending malformed vote extensions, requiring high-privilege access to exploit.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2fcv-qww3-9v6h?
GHSA-2fcv-qww3-9v6h is a denial of service vulnerability in github.com/babylonlabs-io/babylon, published on 24 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Summary
Adversarial validators can send large vote extensions by using non-existing protobuf tags. This will result in the rejection of the subsequent block proposal. Eventually, all block proposals will be rejected by all validators.
Impact
A small group of adversarial validators can cause a chain halt.
Which versions are affected by GHSA-2fcv-qww3-9v6h?
6 open source packages ship an affected version, including github.com/babylonlabs-io/babylon/v4, github.com/babylonlabs-io/babylon and github.com/babylonlabs-io/babylon/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon Go | All versions | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions | None |
github.com/babylonlabs-io/babylon/v3 Go | All versions | None |
How do I fix GHSA-2fcv-qww3-9v6h?
Upgrade github.com/babylonlabs-io/babylon/v4 to 4.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-2fcv-qww3-9v6h being exploited?
There is no known exploitation of GHSA-2fcv-qww3-9v6h in the wild and no public exploit code.
Sources
Also known as GO-2025-4157.