GO-2025-4025
NoneCVSS
—
EPSS
—
Published
Nov 18, 2025
CISA due date
—
The record
CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/cometbft/cometbft | 0 | 0.37.16 |
| Go | github.com/cometbft/cometbft | 0.38.0-alpha.1 | 0.38.19 |
| go | github.com/cometbft/cometbft | 0.38.0-alpha.1 | 0.38.19 |