{"id":"GO-2024-2471","summary":"Chain halt panic in github.com/cometbft/cometbft","details":"A vulnerability in CometBFT’s validation logic for VoteExtensionsEnableHeight can result in a chain halt when triggered through a governance parameter change proposal on an ABCI2 Application Chain. If a parameter change proposal including a VoteExtensionsEnableHeight modification is passed, nodes running the affected versions may panic, halting the network.","aliases":["GHSA-qr8r-m495-7hc4"],"modified":"2024-05-20T16:03:47Z","published":"2024-01-23T18:35:24Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2024-2471"},"references":[{"type":"ADVISORY","url":"https://github.com/cometbft/cometbft/security/advisories/GHSA-qr8r-m495-7hc4"},{"type":"FIX","url":"https://github.com/cometbft/cometbft/commit/5fbc97378b94b0945febe9549399e7c9c5df13ed"}],"affected":[{"package":{"name":"github.com/cometbft/cometbft","ecosystem":"Go","purl":"pkg:golang/github.com/cometbft/cometbft"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.38.0"},{"fixed":"0.38.3"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cometbft/cometbft/types","symbols":["ConsensusParams.ValidateUpdate"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2024-2471.json"}}],"schema_version":"1.7.3","credits":[{"name":"@dongsam"}]}