GHSA-m6wq-66p2-c8pc Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers
A malicious validator can crash consensus nodes by sending vote extensions with missing block hashes, causing a null pointer dereference panic.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-m6wq-66p2-c8pc?
GHSA-m6wq-66p2-c8pc is a vulnerability in github.com/babylonlabs-io/babylon, published on 8 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Summary
A vulnerability exists in Babylon’s BLS vote extension processing where a malicious active validator can submit a VoteExtension with the block_hash field omitted from the protobuf serialization. Because protobuf fields are optional, unmarshalling succeeds but leaves BlockHash as nil. Babylon then dereferences this nil pointer in consensus-critical code paths (notably VerifyVoteExtension, and also proposal-time vote verification), causing a runtime panic.
Impact
Intermittent validator crashes at epoch boundaries, which would slow down the creation of the epoch boundary block.
Finder
Vulnerability discovered by:
- @GrumpyLaurie55348
Which versions are affected by GHSA-m6wq-66p2-c8pc?
12 open source packages ship an affected version, including github.com/babylonlabs-io/babylon, github.com/babylonlabs-io/babylon/v2 and github.com/babylonlabs-io/babylon/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/babylonlabs-io/babylon Go | All versions | None |
github.com/babylonlabs-io/babylon Go | All versions to 1.1.0 | None |
github.com/babylonlabs-io/babylon Go | All versions to 1.1.0 | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions to 2.3.2 | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions to 2.3.2 | None |
6 more packages
github.com/babylonlabs-io/babylon/v3 Go | All versions | None |
github.com/babylonlabs-io/babylon/v3 Go | All versions to 3.0.0-snapshot.250805a | None |
github.com/babylonlabs-io/babylon/v3 Go | All versions to 3.0.0-snapshot.250805a | None |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.2.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.2.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.2.0 |
How do I fix GHSA-m6wq-66p2-c8pc?
Apply the vendor's patch.
Is GHSA-m6wq-66p2-c8pc being exploited?
There is no known exploitation of GHSA-m6wq-66p2-c8pc in the wild and no public exploit code.
Sources
Also known as GO-2025-4211.