CVE-2020-15091: Denial of Service in TenderMint
Summary
CVE-2020-15091: Denial of Service in TenderMint. Affects github.com/tendermint/tendermint versions < 0.33.6. Fixed in 0.33.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TenderMint is an open-source software package written in Go that provides a Byzantine Fault Tolerant (BFT) consensus algorithm. It is commonly used as the consensus engine for blockchain networks. The vulnerability in TenderMint version 0.33.0 and above allows block proposers to include signatures for the wrong block. This can occur if a network is restarted without changing the chainID, which is a misconfiguration. As a result, correct block proposers may accidentally include signatures for the wrong block, causing commits to fail validation and making all proposed blocks invalid. This vulnerability can be exploited by a malicious validator to completely halt the network.
Vulnerability Detail
The vulnerability in TenderMint has two main aspects:
-
Denial of Service: TenderMint versions 0.33.0 and above allow block proposers to include signatures for the wrong block. If a network is restarted without changing the chainID, correct block proposers may inadvertently include signatures for the wrong block. This leads to commits failing validation and renders all proposed blocks invalid. A malicious validator can exploit this vulnerability to halt the network.
-
False Witness: TenderMint versions 0.33.1 and above do not fully verify commit signatures during block execution. After reaching the +2/3 threshold, proposers can include arbitrary signature data for the remaining signatures. This can impact incentivization logic in applications that depend on the LastCommitInfo sent in BeginBlock, as proposers can claim bonuses without waiting for the actual signatures. This vulnerability can be used to manipulate the application's incentivization system.
How To Fix
Latest published version: v0.35.9 as of 23 Oct 2026
go get github.com/tendermint/tendermint@v0.35.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.33.6
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.33.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version of TenderMint to mitigate the risk.
Conclusion
The vulnerability in TenderMint allows block proposers to include signatures for the wrong block, leading to commits failing validation and making all proposed blocks invalid. This can be exploited by a malicious validator to halt the network. It is crucial to upgrade to TenderMint version 0.33.6 or above to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
TenderMint is an open-source software package that provides a Byzantine Fault Tolerant (BFT) consensus algorithm. It is commonly used as the consensus engine for blockchain networks.
This vulnerability allows block proposers to include signatures for the wrong block, leading to commits failing validation and making all proposed blocks invalid. It can be exploited by a malicious validator to halt the network.
The False Witness aspect of this vulnerability allows proposers to include arbitrary signature data for the remaining signatures after reaching the +2/3 threshold. This can be used to manipulate the incentivization logic in applications that depend on the LastCommitInfo.
To fix this vulnerability, it is recommended to upgrade to TenderMint version 0.33.6 or above.
There are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
