{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-15T13:04:26.420","vulnerabilities":[{"cve":{"id":"CVE-2025-24371","sourceIdentifier":"security-advisories@github.com","published":"2025-02-03T22:15:28.460","lastModified":"2025-02-03T22:15:28.460","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround."},{"lang":"es","value":"CometBFT es un motor de replicación de máquina de estados determinista, tolerante a fallas bizantinas y distribuido. En el protocolo `blocksync`, los pares envían sus alturas `base` y `latest` cuando se conectan a un nuevo nodo (`A`), que se sincroniza con la punta de una red. `base` actúa como una base inferior e informa a `A` que el par solo tiene bloques que comienzan con la altura `base`. La altura `latest` informa a `A` sobre el último bloque en una red. Normalmente, los nodos solo informarían alturas crecientes. Si `B` no proporciona el último bloque, `B` se elimina y la altura `latest` (altura objetivo) se recalcula en función de las alturas `latest` de otros nodos. Sin embargo, el código existente no verifica el caso en el que `B` primero informa la `latest` altura `X` e inmediatamente después la altura `Y`, donde `X > Y`. `A` intentará alcanzar el 2000 indefinidamente. Esta condición requiere la introducción de código malicioso en el nodo completo que primero informa una altura `latest` inexistente, luego informa una altura `latest` menor y nodos que se sincronizan mediante el protocolo `blocksync`. Este problema se ha corregido en las versiones 1.0.1 y 0.38.17 y se recomienda a todos los usuarios que actualicen. Los operadores pueden intentar prohibir el acceso de pares maliciosos a la red como workaround."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:N\/VA:H\/SC:N\/SI:N\/SA:N\/E:X\/CR:X\/IR:X\/AR:X\/MAV:X\/MAC:X\/MAT:X\/MPR:X\/MUI:X\/MVC:X\/MVI:X\/MVA:X\/MSC:X\/MSI:X\/MSA:X\/S:X\/AU:X\/R:X\/V:X\/RE:X\/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-703"}]}],"references":[{"url":"https:\/\/github.com\/cometbft\/cometbft\/releases\/tag\/v0.38.17","source":"security-advisories@github.com"},{"url":"https:\/\/github.com\/cometbft\/cometbft\/releases\/tag\/v1.0.1","source":"security-advisories@github.com"},{"url":"https:\/\/github.com\/cometbft\/cometbft\/security\/advisories\/GHSA-22qq-3xwm-r5x4","source":"security-advisories@github.com"}]}}]}