GHSA-m6wq-66p2-c8pc

Suggest an improvement
Source
https://github.com/advisories/GHSA-m6wq-66p2-c8pc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-m6wq-66p2-c8pc/GHSA-m6wq-66p2-c8pc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m6wq-66p2-c8pc
Aliases
Published
2025-12-08T22:20:24Z
Modified
2025-12-17T01:20:34.876818Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers
Details

Summary

A vulnerability exists in Babylon’s BLS vote extension processing where a malicious active validator can submit a VoteExtension with the block_hash field omitted from the protobuf serialization. Because protobuf fields are optional, unmarshalling succeeds but leaves BlockHash as nil. Babylon then dereferences this nil pointer in consensus-critical code paths (notably VerifyVoteExtension, and also proposal-time vote verification), causing a runtime panic.

Impact

Intermittent validator crashes at epoch boundaries, which would slow down the creation of the epoch boundary block.

Finder

Vulnerability discovered by:

  • @GrumpyLaurie55348
Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-476"
    ],
    "github_reviewed_at": "2025-12-08T22:20:24Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Go
github.com/babylonlabs-io/babylon/v4

Package

Name
github.com/babylonlabs-io/babylon/v4
View open source insights on deps.dev
Purl
pkg:golang/github.com/babylonlabs-io/babylon/v4

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-m6wq-66p2-c8pc/GHSA-m6wq-66p2-c8pc.json"
github.com/babylonlabs-io/babylon/v3

Package

Name
github.com/babylonlabs-io/babylon/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/babylonlabs-io/babylon/v3

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.0.0-snapshot.250805a

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-m6wq-66p2-c8pc/GHSA-m6wq-66p2-c8pc.json"
github.com/babylonlabs-io/babylon/v2

Package

Name
github.com/babylonlabs-io/babylon/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/babylonlabs-io/babylon/v2

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
2.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-m6wq-66p2-c8pc/GHSA-m6wq-66p2-c8pc.json"
github.com/babylonlabs-io/babylon

Package

Name
github.com/babylonlabs-io/babylon
View open source insights on deps.dev
Purl
pkg:golang/github.com/babylonlabs-io/babylon

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.1.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-m6wq-66p2-c8pc/GHSA-m6wq-66p2-c8pc.json"