CVE-2025-24371: CometBFT Blocksync Protocol DoS Flaw

CVE-2025-24371 Overview

CVE-2025-24371 affects CometBFT, a distributed Byzantine fault-tolerant state machine replication engine used across blockchain networks. The vulnerability exists in the blocksync protocol, which fails to validate that peer-reported latest heights only increase over time. A malicious full node can advertise a high latest height and then report a lower one, causing a syncing node to chase an unreachable target block indefinitely. This flaw is classified under [CWE-703] Improper Check or Handling of Exceptional Conditions and results in a denial of service against nodes joining the network.

Critical Impact
Syncing nodes can be stalled indefinitely by a malicious peer, disrupting blockchain participation and consensus availability.

Affected Products

CometBFT versions prior to 0.38.17
CometBFT versions prior to 1.0.1
Blockchain networks and applications relying on the blocksync protocol for state replication

Discovery Timeline

2025-02-03 - CVE-2025-24371 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24371

Vulnerability Analysis

CometBFT nodes use the blocksync protocol to catch up to the tip of a network. When peers connect to a syncing node A, they report two heights: base (the lowest block available from the peer) and latest (the peer's current tip). Node A aggregates these values to determine a target height and begins requesting blocks up to that target.

The protocol assumes peers advertise monotonically increasing latest heights. When a peer fails to deliver an expected block, it is removed and the target height is recalculated from remaining peers. The implementation, however, does not reject the case where a peer first reports latest = X and then immediately reports latest = Y where X > Y. The syncing node retains the inflated target and continues requesting blocks that do not exist on the network.

Root Cause

The root cause is missing validation of peer state transitions in the block synchronization reactor. The code accepts any latest height update from a connected peer without verifying that the new value is greater than or equal to the previously reported one. This violates the implicit protocol invariant that block heights only advance forward in time.

Attack Vector

Exploitation requires an attacker to run a modified full node with malicious code that manipulates the reported latest height. The attacker connects to victim nodes performing initial sync via the blocksync protocol and advertises a non-existent future height, followed by a lower valid height. The victim node accepts the inflated target and continues attempting to reach it indefinitely. Because the attack is delivered over the peer-to-peer network with only peer-level privileges, no user interaction is required. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-22qq-3xwm-r5x4.

Detection Methods for CVE-2025-24371

Indicators of Compromise

Syncing nodes stuck at a fixed target block height for extended periods with no progress toward tip
Peer connections reporting latest heights that decrease between successive updates
Repeated block requests for heights that no other peer in the network reports as available
Anomalous blocksync reactor log entries showing target height recalculations that never converge

Detection Strategies

Monitor CometBFT node metrics for blocksync target height versus current height gaps that persist beyond expected sync windows
Instrument the block synchronization reactor to log any peer reporting a latest height lower than a previously advertised value
Correlate peer identity with sync stall events to identify malicious full nodes acting as sync poisoners

Monitoring Recommendations

Track the cometbft_blocksync_latest_block_height metric and alert when it exceeds the known network tip observed from trusted peers
Log peer disconnections and reconnections with the reported base and latest heights for forensic review
Establish baselines for expected sync duration and alert on nodes that fail to reach tip within the baseline window

How to Mitigate CVE-2025-24371

Immediate Actions Required

Upgrade CometBFT to version 1.0.1 or 0.38.17 on all validator, sentry, and full nodes performing block synchronization
Audit peer lists and remove untrusted or unknown full nodes from persistent peer configurations
Restart syncing nodes that are currently stalled at unreachable target heights after applying the patch

Patch Information

The issue has been patched in CometBFT v0.38.17 and v1.0.1. The patches add validation to reject peer state updates that report a decreasing latest height, ensuring the target height calculation cannot be poisoned by malicious peers.

Workarounds

Ban peers that advertise non-monotonic latest heights using the operator's peer management controls
Restrict blocksync peer connections to a curated list of trusted full nodes via the persistent_peers and private_peer_ids configuration options
Use state sync or trusted snapshots as an alternative bootstrap path until the patched version is deployed

bash

# Configuration example: restrict blocksync to trusted peers in config.toml
[p2p]
persistent_peers = "nodeid1@trusted-host-1:26656,nodeid2@trusted-host-2:26656"
persistent_peers_max_dial_period = "0s"
addr_book_strict = true