GO-2025-4025

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2025-4025
Import Source
https://vuln.go.dev/ID/GO-2025-4025.json
JSON Data
https://api.test.osv.dev/v1/vulns/GO-2025-4025
Aliases
Published
2025-11-18T15:44:15Z
Modified
2025-11-18T16:12:43.512304Z
Summary
CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
Details

CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-4025"
}
References

Affected packages

Go / github.com/cometbft/cometbft

Package

Name
github.com/cometbft/cometbft
View open source insights on deps.dev
Purl
pkg:golang/github.com/cometbft/cometbft

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.37.16
Introduced
0.38.0-alpha.1
Fixed
0.38.19

Ecosystem specific 

{
    "imports": [
        {
            "symbols": [
                "BaseWAL.OnStart",
                "BaseWAL.SearchForEndHeight",
                "Handshaker.Handshake",
                "Handshaker.HandshakeWithContext",
                "Handshaker.ReplayBlocks",
                "Handshaker.ReplayBlocksWithContext",
                "MsgFromProto",
                "NewState",
                "NewValidBlockMessage.ValidateBasic",
                "PeerState.ApplyHasVoteMessage",
                "PeerState.ApplyVoteSetBitsMessage",
                "PeerState.EnsureVoteBitArrays",
                "PeerState.InitProposalBlockParts",
                "PeerState.PickSendVote",
                "PeerState.PickVoteToSend",
                "PeerState.SetHasProposal",
                "PeerState.SetHasProposalBlockPart",
                "PeerState.SetHasVote",
                "ProposalPOLMessage.ValidateBasic",
                "Reactor.AddPeer",
                "Reactor.OnStart",
                "Reactor.Receive",
                "Reactor.SwitchToConsensus",
                "RunReplayFile",
                "State.OnStart",
                "State.OpenWAL",
                "State.ReplayFile",
                "VoteSetBitsMessage.ValidateBasic",
                "WALDecoder.Decode",
                "WALFromProto",
                "WALGenerateNBlocks",
                "WALWithNBlocks"
            ],
            "path": "github.com/cometbft/cometbft/consensus"
        },
        {
            "symbols": [
                "BitArray.And",
                "BitArray.Or",
                "BitArray.PickRandom",
                "BitArray.SetIndex",
                "BitArray.Sub",
                "BitArray.UnmarshalJSON",
                "BitArray.copyBits",
                "BitArray.getNumTrueIndices",
                "BitArray.setIndex",
                "NewBitArray",
                "NewBitArrayFromFn"
            ],
            "path": "github.com/cometbft/cometbft/libs/bits"
        }
    ]
}