CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2025-3442" }
{ "imports": [ { "path": "github.com/cometbft/cometbft/blocksync", "symbols": [ "BlockPool.SetPeerRange", "Reactor.Receive" ] } ] }
{ "imports": [ { "path": "github.com/cometbft/cometbft/internal/blocksync", "symbols": [ "BlockPool.SetPeerRange", "Reactor.Receive" ] } ] }