Read the docs
TI-2025-43846 Aliases GHSA-m6wq-66p2-c8pc

Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

Priority LOW 38CWE-476Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-476.

Summary

### Summary A vulnerability exists in Babylon’s BLS vote extension processing where a malicious active validator can submit a VoteExtension with the `block_hash` field omitted from the protobuf serialization. Because protobuf fields are optional, unmarshalling succeeds but leaves `BlockHash` as nil. Babylon then dereferences this nil pointer in consensus-critical code paths (notably `VerifyVoteExtension`, and also proposal-time vote verification), causing a runtime panic. ### Impact Intermittent validator crashes at epoch boundaries, which would slow down the creation of the epoch boundary block. ### Finder Vulnerability discovered by: - @GrumpyLaurie55348

Why it matters now

Fix Fixed github.com/babylonlabs-io/babylon/v4 (Go): 4.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/babylonlabs-io/babylon/v4 (Go)before 4.2.04.2.0Patch availableGHSA-m6wq-66p2-c8pc
—github.com/babylonlabs-io/babylon/v3 (Go)up to 3.0.0-snapshot.250805a—No fix listedGHSA-m6wq-66p2-c8pc
—github.com/babylonlabs-io/babylon/v2 (Go)up to 2.3.2—No fix listedGHSA-m6wq-66p2-c8pc
—github.com/babylonlabs-io/babylon (Go)up to 1.1.0—No fix listedGHSA-m6wq-66p2-c8pc
  • github.com/babylonlabs-io/babylon/v4 (Go) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-m6wq-66p2-c8pc
  • github.com/babylonlabs-io/babylon/v3 (Go) Vendor— Affected up to 3.0.0-snapshot.250805a Fixed in — No fix listed GHSA-m6wq-66p2-c8pc
  • github.com/babylonlabs-io/babylon/v2 (Go) Vendor— Affected up to 2.3.2 Fixed in — No fix listed GHSA-m6wq-66p2-c8pc
  • github.com/babylonlabs-io/babylon (Go) Vendor— Affected up to 1.1.0 Fixed in — No fix listed GHSA-m6wq-66p2-c8pc

Remediation

  • Fix · GHSA-m6wq-66p2-c8pc github.com/babylonlabs-io/babylon/v4 (Go) Fixed in 4.2.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-m6wq-66p2-c8pc

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences