CVE-2021-21271: Uncontrolled Resource Consumption in Tendermint Core
Summary
CVE-2021-21271: Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint. Affects github.com/tendermint/tendermint versions >= 0.34.0, < 0.34.3. Fixed in 0.34.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendermint Core is a Go-based software package that provides the core consensus engine for the Tendermint blockchain platform. It is responsible for forming blocks and handling evidence of misbehavior. The package is widely used in various blockchain networks.
Vulnerability Detail
The vulnerability in Tendermint Core (v0.34.0 - v0.34.2) arises from the handling of evidence of misbehavior. When forming DuplicateVoteEvidence, different nodes in the network may assign different timestamps due to the block not being finalized through network consensus. This inconsistency leads to the formation of invalid DuplicateVoteEvidence, causing a denial-of-service (DoS) vector. The impact of this vulnerability is a potential disruption of network operations.
How To Fix
Latest published version: v0.35.9 as of 23 Oct 2026
go get github.com/tendermint/tendermint@v0.35.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.34.3
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.34.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Upgrading to the patched version is the only solution.
Conclusion
The vulnerability in Tendermint Core (CVE-2021-21271) can be mitigated by updating to the patched version (v0.34.3 or later). It is crucial for network administrators to promptly apply the patch to prevent potential denial-of-service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
Tendermint Core is a Go-based software package that provides the core consensus engine for the Tendermint blockchain platform. It is responsible for forming blocks and handling evidence of misbehavior.
The vulnerability in Tendermint Core (v0.34.0 - v0.34.2) can be exploited as a denial-of-service (DoS) vector, potentially disrupting network operations.
To fix this vulnerability, it is recommended to update to Tendermint Core v0.34.3 or later. This version includes a patch that addresses the issue and ensures consistent timestamps for DuplicateVoteEvidence.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the only solution.
The vulnerability was discovered and reported by Crypto.com (@cyril-crypto, @brianatcrypto, @tomtau, and @yihuang). The root cause was identified and patched by @melekes and @cmwaters.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
