{"id":"GO-2026-4361","summary":"Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft","details":"Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft","aliases":["GHSA-c32p-wcqj-j677"],"modified":"2026-02-25T20:15:11Z","published":"2026-02-19T17:28:55Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4361"},"references":[{"type":"ADVISORY","url":"https://github.com/cometbft/cometbft/security/advisories/GHSA-c32p-wcqj-j677"},{"type":"FIX","url":"https://github.com/cometbft/cometbft/commit/bf8274fcdbcab2bc652660ae627196a90a6efb97"},{"type":"WEB","url":"https://github.com/cometbft/cometbft/releases/tag/v0.37.18"},{"type":"WEB","url":"https://github.com/cometbft/cometbft/releases/tag/v0.38.21"}],"affected":[{"package":{"name":"github.com/cometbft/cometbft","ecosystem":"Go","purl":"pkg:golang/github.com/cometbft/cometbft"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.37.18"},{"introduced":"0.38.0-alpha.1"},{"fixed":"0.38.21"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4361.json"}}],"schema_version":"1.7.3"}