CometBFT zero-day vulnerability exposed, $8.0 billion Cosmos network nodes face a risk of permanent lockup

Security researcher Doyeon Park disclosed on April 21 that there is a critical high-severity zero-day vulnerability in the Cosmos consensus layer CometBFT, rated at CVSS 7.1. It could allow malicious peers to attack nodes during the BlockSync stage of block synchronization and lead them into a deadlock, impacting a network that safeguards more than $8 billion in assets.

Vulnerability technical principle: infinite deadlock caused by malicious nodes reporting high blocks repeatedly

The vulnerability exists in CometBFT’s BlockSync mechanism. Under normal circumstances, when connecting, peers report incrementally increasing latest block heights. However, the current code does not verify the scenario where a peer reports a higher height X first and then reports a lower height Y—for example, reporting 2000 first and then 1001. In that case, the node in synchronization (node A) will wait indefinitely to catch up to height 2000, even if the malicious peer disconnects; the target height will not be recalculated, causing the node to fall into an infinite deadlock and be unable to rejoin the network. Affected versions are <= v0.38.16 and v1.0.0. Patched versions are v1.0.1 and v0.38.17.

Coordinated disclosure failure: complete timeline of the vendor downgrading the CVE

Park followed the standard Coordinated Vulnerability Disclosure (CVD) process, but the process encountered multiple obstacles: on February 22, Park submitted the first report; the vendor requested it be submitted in the form of a public GitHub issue but refused to disclose publicly. On March 4, the second report was marked as spam by HackerOne. On March 6, the vendor unilaterally downgraded the severity from “medium/high” to “informational (impact is negligible).” Park submitted a network-level concept proof (PoC) to rebut the downgrade. On April 21, the final decision was made to disclose publicly.

Park also noted that the vendor had previously performed similar downgrade actions for the CVE-2025-24371 vulnerability, which has the same impact, and this is considered to violate internationally recognized vulnerability assessment standards such as CVSS.

Emergency guidance: actions validators need to take now

Before the patch is formally deployed, Park recommends that all Cosmos validators avoid restarting nodes as much as possible. Nodes that are already in consensus mode can continue running normally; however, if restarted and entering the BlockSync synchronization process, they may become stuck in a deadlock due to attacks by malicious peers.

As a temporary mitigation: if BlockSync becomes stuck, you can identify malicious peers that report invalid heights by increasing the log level, and then block that peer at the P2P layer. The most fundamental solution is to upgrade as soon as possible to the patched version v1.0.1 or v0.38.17.

Frequently asked questions

Can this CometBFT vulnerability directly steal funds?

No. This vulnerability cannot directly steal assets or put funds on-chain security at risk. Its impact is to cause nodes to enter a deadlock during the BlockSync synchronization phase, preventing nodes from participating normally in the network. This may affect validators’ ability to propose blocks and cast votes, thereby impacting the activity of the related blockchain.

How can validators determine whether a node has been attacked by this vulnerability?

If a node is stuck in the BlockSync phase, the target height stopping its increase is a possible sign. You can increase the log level of the BlockSync module, check whether there are records of peer nodes that have received anomalous height messages, in order to identify potential malicious nodes, and then block them at the P2P layer.

Is it standard for the vendor to downgrade the vulnerability to “informational”?

Park’s CVSS score (7.1, high severity) is based on standard international scoring methodologies, and Park also submitted a verifiable network-level PoC to rebut the downgrade decision. When the vendor downgraded it to “impact is negligible,” the security community considers this to violate internationally recognized vulnerability assessment standards such as CVSS. This controversy is also one of the core reasons Park ultimately decided to disclose publicly.