https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 22:02:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-231888 EUVD-2026-231888 https://cve.radiocsirt.org/vuln/euvd-2026-231888 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23507 <p>Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds.</p> <p>Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-23507 https://cve.radiocsirt.org/vuln/ghsa-xqqc-c5gw-c5r5 <p><strong>Affected:</strong> crates.io: tendermint-light-client-verifier, crates.io: tendermint-light-client, crates.io: tendermint-light-client-js</p> <p>### Impact</p> <p>Anyone using the `tendermint-light-client` and related packages to perform light client verification (e.g. IBC-rs, Hermes).</p> <p>At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client.</p> <p>The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks.</p> <p>### Patches</p> <p>Users of the light client-related crates can currently upgrade to `v0.28.0`.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [Light Client specification](https://github.com/tendermint/tendermint/tree/main/spec/light-client)</p> <p><strong>Affected:</strong> crates.io: tendermint-light-client-verifier, crates.io: tendermint-light-client, crates.io: tendermint-light-client-js</p> <p>### Impact</p> <p>Anyone using the `tendermint-light-client` and related packages to perform light client verification (e.g. IBC-rs, Hermes).</p> <p>At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client.</p> <p>The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks.</p> <p>### Patches</p> <p>Users of the light client-related crates can currently upgrade to `v0.28.0`.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [Light Client specification](https://github.com/tendermint/tendermint/tree/main/spec/light-client)</p> https://cve.radiocsirt.org/vuln/ghsa-xqqc-c5gw-c5r5 https://cve.radiocsirt.org/vuln/gsd-2022-23507 gsd-2022-23507 https://cve.radiocsirt.org/vuln/gsd-2022-23507