{"answers":{"affected":"5 open source packages ship an affected version, including github.com/cometbft/cometbft.","exploited":"There is no known exploitation of GHSA-hrhf-2vcr-ghch in the wild and no public exploit code.","fix":"Upgrade github.com/cometbft/cometbft to a fixed version for your release line: 0.37.16 or 0.38.19.","what":"GHSA-hrhf-2vcr-ghch is a denial of service vulnerability in github.com/cometbft/cometbft, published on 14 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-hrhf-2vcr-ghch and fix it if it is affected.\n\nWhat it is: GHSA-hrhf-2vcr-ghch is a denial of service vulnerability in github.com/cometbft/cometbft, published on 14 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-hrhf-2vcr-ghch in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cometbft/cometbft (Go): affected all versions; fixed in 0.37.16, 0.38.19\n- github.com/cometbft/cometbft (Go): affected all versions; fixed in 0.37.16\n- github.com/cometbft/cometbft (Go): affected all versions; fixed in 0.37.16\n- github.com/cometbft/cometbft (Go): affected from 0.38.0-alpha.1; fixed in 0.38.19\n- github.com/cometbft/cometbft (Go): affected from 0.38.0-alpha.1; fixed in 0.38.19\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-hrhf-2vcr-ghch/ (Markdown: https://insights.sbomify.com/GHSA-hrhf-2vcr-ghch/index.md)","id":"GHSA-hrhf-2vcr-ghch","markdown":"https://insights.sbomify.com/GHSA-hrhf-2vcr-ghch/index.md","name":"GHSA-hrhf-2vcr-ghch","record":{"aliases":["GO-2025-4025"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"CometBFT consensus engine","requires_auth":"none","summary":"Attackers can halt the network by sending invalid BitArray messages to CometBFT nodes, affecting validators and full nodes.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Name: ASA-2025-003: Invalid BitArray handling can lead to network halt\nCriticality: High (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: `\u003c= v0.38.18`, `\u003c= v0.37.15`, and `main` development branches\nAffected users: Validators, Full nodes, Users\n\n### Description\n\nA bug was discovered in CometBFT's handling of `BitArray`'s that have a mismatch between the `BitArray`'s expected number of `Elems` for the specified number of `Bits`. Additional validation was added to prevent processing `BitArray`'s in this invalid state, as well as guards to prevent panics on `BitArray` methods if one of these invalid states is processed.\n\n### Impact\n`BitArray`'s are present in a number of messages received from peers. When handling these messages, insufficient validation was applied to prevent processing messages the aforementioned invalid state. In the worst case, nodes will gossip messages to peers in an invalid state before processing them themselves, leading to a network halt (instead of only the node receiving the malicious message crashing). \n\n### Patches\n\nThe new CometBFT releases [v0.38.19](https://github.com/cometbft/cometbft/releases/tag/v0.38.19) and [v0.37.16](https://github.com/cometbft/cometbft/releases/tag/v0.37.16) fix this issue.\n\nUnreleased code in the main branch is patched as well.\n\n### Workarounds\n\nIf a node is able to identify a malicious peer sending these payloads, they can ban the ip address using common tools like `iptables`.\n\n### Timeline\n\n* October 3, 2025, 11:26am EST: Issue reported to Cosmos Labs via an external team (via their Bug Bounty Program).\n* October 3, 2025, 11:59am EST: Issue triaged by core team and core team completes validation of issue.\n* October 6, 2025, 11:14pm EST: Issue reported to the Cosmos Bug Bounty Program (by original white hat reporter).\n* October 9, 2025, 11:15am EST: Pre-notification delivered.\n* October 10, 2025, 11:37am EST: Core team completes patch for the issue.\n* October 14, 2025, 11:00am EST: Patch made available.\n\nThis issue was reported by @whoismxuse to the Cosmos Bug Bounty Program on HackerOne on October 6, 2025. If you believe you have found a bug in the Cosmos Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf there are questions about Cosmos security efforts, please reach out to our official communication channel at [security@cosmoslabs.io](mailto:security@cosmoslabs.io).\n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch). For more information about CometBFT, see https://docs.cometbft.com/.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"CometBFT's invalid BitArray handling can lead to network halt","id":"GHSA-hrhf-2vcr-ghch","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":5,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.37.16","0.38.19"],"introduced":["0","0.38.0-alpha.1"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GO-2025-4025"},{"ecosystem":"Go","fixed":["0.37.16"],"introduced":["0"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":null,"source":"GHSA-hrhf-2vcr-ghch"},{"ecosystem":"Go","fixed":["0.37.16"],"introduced":["0"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GHSA-hrhf-2vcr-ghch"},{"ecosystem":"Go","fixed":["0.38.19"],"introduced":["0.38.0-alpha.1"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":null,"source":"GHSA-hrhf-2vcr-ghch"},{"ecosystem":"Go","fixed":["0.38.19"],"introduced":["0.38.0-alpha.1"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GHSA-hrhf-2vcr-ghch"}],"products":null,"published":"2025-10-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can halt the network by sending invalid BitArray messages to CometBFT nodes, affecting validators and full nodes.","url":"https://insights.sbomify.com/GHSA-hrhf-2vcr-ghch/"}