CVE-2019-25072: Uncontrolled Resource Consumption in Tendermint Client package
Summary
CVE-2019-25072: Tendermint Client package vulnerable to Uncontrolled Resource Consumption. Affects github.com/tendermint/tendermint versions < 0.31.1. Fixed in 0.31.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Tendermint Client package, developed in Go, is a software library that provides functionality for interacting with the Tendermint blockchain. It allows users to send requests to the blockchain and receive responses. The package supports Gzip compression in request bodies, which can be used to reduce the size of data being sent. However, due to a lack of limiting response body sizes, a malicious server can exploit this feature to cause the client to consume excessive system resources. This vulnerability can be used as a denial of service vector, potentially leading to system instability or unavailability.
Vulnerability Detail
The vulnerability (CVE-2019-25072) arises from the combination of Gzip compression support in request bodies and the absence of restrictions on response body sizes. By sending specially crafted responses, a malicious server can cause the Tendermint Client to consume a significant amount of system resources. This can lead to a denial of service (DoS) attack, where the client becomes overwhelmed and unable to handle legitimate requests. The impact of this vulnerability can range from degraded performance to complete unavailability of the affected system.
How To Fix
Latest published version: v0.35.9 as of 23 Oct 2026
go get github.com/tendermint/tendermint@v0.35.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.1
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.31.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Tendermint Client package to mitigate the risk of exploitation.
Conclusion
The Tendermint Client package is vulnerable to uncontrolled resource consumption, which can be exploited by a malicious server to launch a denial of service attack. To mitigate this risk, it is crucial to update the package to version 0.31.1 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
The vulnerability can be exploited to launch a denial of service (DoS) attack, potentially causing system instability or unavailability.
To fix this vulnerability, update the Tendermint Client package to version 0.31.1 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Yes, this vulnerability can be exploited remotely by a malicious server.
There is no evidence of active exploitation of this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
