-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cometbft/cometbft | go | >= 0.38.0, < 0.38.3 | 0.38.3 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation in the ValidateUpdate method of ConsensusParams. The commit diff shows significant changes to this function's validation logic, adding multiple conditional checks (cases 1-9 in comments) that were missing in vulnerable versions. The original implementation failed to properly handle scenarios like disabling already-activated vote extensions or setting enable heights in the past, which the patched version explicitly addresses. The associated test file (types/params_test.go) was also substantially expanded to cover these failure scenarios, confirming the function's central role in the vulnerability.
Ongoing coverage of React2Shell