Summary
CometBFT's invalid BitArray handling can lead to network halt
Name: ASA-2025-003: Invalid BitArray handling can lead to network halt
Criticality: High (Considerable Impact; Possible Likelihood per ACMv1.2)
Affected versions: <= v0.38.18, <= v0.37.15, and main development branches
Affected users: Validators, Full nodes, Users
Description
A bug was discovered in CometBFT's handling of BitArray's that have a mismatch between the BitArray's expected number of Elems for the specified number of Bits. Additional validation was added to prevent processing BitArray's in this invalid state, as well as guards to prevent panics on BitArray methods if one of these invalid states is processed.
Workarounds
If a node is able to identify a malicious peer sending these payloads, they can ban the ip address using common tools like iptables.
Timeline
- October 3, 2025, 11:26am EST: Issue reported to Cosmos Labs via an external team (via their Bug Bounty Program).
- October 3, 2025, 11:59am EST: Issue triaged by core team and core team completes validation of issue.
- October 6, 2025, 11:14pm EST: Issue reported to the Cosmos Bug Bounty Program (by original white hat reporter).
- October 9, 2025, 11:15am EST: Pre-notification delivered.
- October 10, 2025, 11:37am EST: Core team completes patch for the issue.
- October 14, 2025, 11:00am EST: Patch made available.
This issue was reported by @whoismxuse to the Cosmos Bug Bounty Program on HackerOne on October 6, 2025. If you believe you have found a bug in the Cosmos Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.
If there are questions about Cosmos security efforts, please reach out to our official communication channel at [email protected].
A Github Security Advisory for this issue is available in the CometBFT repository. For more information about CometBFT, see https://docs.cometbft.com/.
Impact
BitArray's are present in a number of messages received from peers. When handling these messages, insufficient validation was applied to prevent processing messages the aforementioned invalid state. In the worst case, nodes will gossip messages to peers in an invalid state before processing them themselves, leading to a network halt (instead of only the node receiving the malicious message crashing).
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The new CometBFT releases v0.38.19 and v0.37.16 fix this issue.
Unreleased code in the main branch is patched as well.
Frequently Asked Questions
- What is GHSA-HRHF-2VCR-GHCH? GHSA-HRHF-2VCR-GHCH is a high-severity security vulnerability in github.com/cometbft/cometbft (go), affecting versions <= 0.37.15. It is fixed in 0.37.16, 0.38.19.
- Which versions of github.com/cometbft/cometbft are affected by GHSA-HRHF-2VCR-GHCH? github.com/cometbft/cometbft (go) versions <= 0.37.15 is affected.
- Is there a fix for GHSA-HRHF-2VCR-GHCH? Yes. GHSA-HRHF-2VCR-GHCH is fixed in 0.37.16, 0.38.19. Upgrade to this version or later.
- Is GHSA-HRHF-2VCR-GHCH exploitable, and should I be worried? Whether GHSA-HRHF-2VCR-GHCH is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-HRHF-2VCR-GHCH is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-HRHF-2VCR-GHCH?
- Upgrade
github.com/cometbft/cometbftto 0.37.16 or later - Upgrade
github.com/cometbft/cometbftto 0.38.19 or later
- Upgrade