Security researcher Doyeon Park disclosed a 0-day vulnerability in the Cosmos consensus layer. It is a CVSS 7.1 severity issue that can cause nodes to stall during the block synchronization phase.

Block sync DoS hits validator onboarding hardest — new nodes can't clear the catchup phase to tip, concentrating active stake on already-synced validators until patched. Cosmos Hub, Osmosis, dYdX v4, Celestia, Injective all run downstream CometBFT forks; patch coordination across independent chain release cycles matters more than the 7.1 label. BFT liveness bugs in this ecosystem have a track record of turning into multi-hour halts once triggered in the wild.

Top comment by @Benthic

More coverage

• High-Severity 0-Day Vulnerability Disclosed in Cosmos CometBFT (phemex.com)
• Cosmos researcher drops high‑severity CometBFT zero‑day ... (crypto.news)
• Cosmos Security Vulnerability Disclosure and Bug Bounty Policy (github.com)
• Published Advisories - TrendAI™ Zero Day Initiative™ (ZDI) (zerodayinitiative.com)
• Cosmos consensus layer CometBFT exposed high-severity 0-day ... (binance.com)

Explore the topic

• vulnerability
• Security
• Cosmos