CVE-2020-15091: Denial of Service in TenderMint
Summary
CVE-2020-15091: Denial of service in github.com/tendermint/tendermint. Affects github.com/tendermint/tendermint versions >= 0.33.0, < 0.34.0-dev1.0.20200702134149-480b995a3172. Fixed in 0.34.0-dev1.0.20200702134149-480b995a3172. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TenderMint is an open-source blockchain consensus engine that allows developers to build applications on top of it. It provides a secure and decentralized way to agree on the state of a distributed ledger. However, versions 0.33.0 and above of TenderMint are vulnerable to a Denial of Service (DoS) attack. This vulnerability allows block proposers to include signatures for the wrong block, leading to the validation failure of all proposed blocks. A malicious validator can exploit this vulnerability to completely halt the network.
Vulnerability Detail
The vulnerability in TenderMint arises from the misconfiguration of reusing chainIDs. When a network is started, runs for some time, and is restarted without changing the chainID, correct block proposers may accidentally include signatures for the wrong block if they see these signatures. This results in commits that won't validate, rendering all proposed blocks invalid. Additionally, starting from version 0.33.1, TenderMint stops fully verifying commit signatures during block execution, only checking for +2/3 majority. This allows proposers to include arbitrary data for the remaining -1/3 of validators' signatures, impacting incentivization logic in the application that depends on the LastCommitInfo sent in BeginBlock. The impact of this vulnerability is a complete halt of the network.
How To Fix
Latest published version: v0.35.9 as of 23 Oct 2026
go get github.com/tendermint/tendermint@v0.35.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.34.0-dev1.0.20200702134149-480b995a3172
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.34.0-dev1.0.20200702134149-480b995a3172Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version of TenderMint to mitigate the risk.
Conclusion
The vulnerability in TenderMint can lead to a complete halt of the network if exploited by a malicious validator. It is crucial to upgrade to version 0.33.6 of TenderMint to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
TenderMint is an open-source blockchain consensus engine that allows developers to build applications on top of it. It provides a secure and decentralized way to agree on the state of a distributed ledger.
The impact of this vulnerability is a complete halt of the network. A malicious validator can exploit this vulnerability to stop the network from functioning.
To fix this vulnerability, it is recommended to upgrade to version 0.33.6 of TenderMint. This version includes the necessary checks to ensure all signatures are for the correct block and verifies all signatures during block execution.
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version of TenderMint to mitigate the risk.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/tendermint/tendermint/issues/4926
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
