Incorrect Provision of Specified Functionality Affecting github.com/cometbft/cometbft/types package, versions <0.37.18>=0.38.0-alpha.1 <0.38.21
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMCOMETBFTCOMETBFTTYPES-15091513
- published25 Jan 2026
- disclosed23 Jan 2026
- creditUnknown
Introduced: 23 Jan 2026
CVE NOT AVAILABLE CWE-684 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/cometbft/cometbft/types to version 0.37.18, 0.38.21 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Provision of Specified Functionality due to inconsistencies between the verification of commit signatures and the derivation of block time. An attacker can disrupt consensus guarantees and manipulate block timestamps by exploiting this inconsistency, potentially impacting any module, smart contract, or system that relies on accurate block time.