GO-2026-4361
NoneCVSS
—
EPSS
—
Published
Feb 19, 2026
CISA due date
—
The record
Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/cometbft/cometbft | 0 | 0.37.18 |
| Go | github.com/cometbft/cometbft | 0.38.0-alpha.1 | 0.38.21 |
| go | github.com/cometbft/cometbft | 0.38.0-alpha.1 | 0.38.21 |