VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/tendermint/tendermint: vulnerability history, versions and safety

github.com/tendermint/tendermint is a package in the Go ecosystem. Vulert records 10 vulnerabilities for it across 120 releases, from Apr 2021 to Dec 2022. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
10 vulnerabilities recorded H1 M3 L1 U5
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/tendermint/tendermint vulnerabilities

Vulert verdict on github.com/tendermint/tendermint v0.35.9 i

Updated on 23 Oct 2026

Action needed: v0.35.9 has 3 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 69/100
  • Security Minor issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.35.9 — affected i
  • Vulnerabilities on record 10 over 1 year · 0 in the last year i
  • Latest disclosure 28 Dec 2022 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 5,863 i
  • OpenSSF scorecard 4/10 i
  • Last release 51 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/tendermint/tendermint, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20250306233957-66ac0bf8b08f 06 Mar 2025 H1 M1 U1 Apache-2.0 Yes Details →
v0.36.0-dev.0.20250306233957-66ac0bf8b08f 06 Mar 2025 H1 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20250306204312-9d1be8603136 06 Mar 2025 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.25-0.20250306204312-9d1be8603136 06 Mar 2025 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.25-0.20230202213552-35581cf54ec4 02 Feb 2023 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.25-0.20230105211629-64747b2b1841 05 Jan 2023 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc2.0.20221222142232-9169ea28ac66 22 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221222005221-a9feb1c023e1 22 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.25-0.20221221220620-936221e0a8d9 21 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221212130415-189d120c9fcb 12 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221208202002-dfb6589d8c47 08 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221207171555-3324f49fb7e7 07 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.25-0.20221205213427-51b003ba79e1 05 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221204111549-c3302b0dc985 04 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221201174622-0952a99f454a 01 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221201121915-739b92bf0151 01 Dec 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221130183619-21b2801c6029 30 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221130123448-18d38dd40935 30 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221129202510-4290ad29829f 29 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221129133214-7efdb6362de1 29 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc2 29 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221129124116-fee53a074d68 29 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc1.0.20221128234118-abc57d28fdf7 28 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221128234018-790132a7d81e 28 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221124145357-8fd66a6e8def 24 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221123234047-88e1de7431f4 23 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221123155958-2d036c59fef9 23 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221122183231-12f0c4a624ea 22 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221122172105-d16f17569ff8 22 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.24 22 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.24-0.20221121183348-342a528f81b4 21 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221121145627-34ca3fb4741c 21 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc1.0.20221121141437-92c797e35300 21 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221118150656-f9bfdf4ce238 18 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221115184801-627b77693f39 15 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221115142740-755e1474b126 15 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221114192842-a7dc8aaf91ba 14 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221111140634-d324430f82f5 11 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221110181315-99a7ac84dca3 10 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221110155910-f12588aab1f1 10 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.24-0.20221110131553-ec471ba27efd 10 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.23 09 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221109120741-c6a0dc85595a 09 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221107134411-ff0f98892f24 07 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221103171944-816c6bac00c6 03 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.23-0.20221103144210-161611cb3caa 03 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221102112505-d704c0a0b6fb 02 Nov 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221031200434-c8f9f061fd9f 31 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc1.0.20221031195155-12f7fcbebf80 31 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221028150116-83b7f4ad5bc7 28 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221027194615-09b870831461 27 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221027151745-d95e423756ec 27 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221026173639-13bd4b63f8fe 26 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221025153054-40a59d1e10c5 25 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221024081923-af2981a2f755 24 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221021203337-3bd215313654 21 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221021180814-d8a16c83caf1 21 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221019214906-301211c2cb75 19 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221019152503-4552cfc2714f 19 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22 18 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc1.0.20221018160428-56873f416670 18 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221018160224-5df9c410ffe1 18 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221018140855-c8f203293de1 18 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-rc1 17 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221017114208-6ea968d576a2 17 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22-0.20221012182156-3ec6e424d6ae 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221012181719-1cf9d8e276af 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20221012175850-b42c43977681 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221012175850-b42c43977681 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221012103120-fe0869cceef6 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221012100911-482606d3a247 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221012094411-d6ee306a16b6 12 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221011190149-957ec0207333 11 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221011115403-387bf6795a4b 11 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22-0.20221010153609-3b4d8e9d166e 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221010142106-4f3e87b2e48d 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22-0.20221010132410-a28c987f5a60 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221010085944-9dd99e92941c 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22-0.20221010084731-1d160a5a86b1 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221010084006-178071a0af34 10 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221009220215-8b3c15b066e8 09 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221009181816-7edd60b7910a 09 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221009142207-dd0fee56924c 09 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221009142200-2cdf48928877 09 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221007135444-4fd19a275ef8 07 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.22-0.20221007122733-430afb23e781 07 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006220421-7cf4d7fe8d95 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006213539-727c6eafe713 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006211325-c555d811825c 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006210824-8203a98887e9 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006210119-4ccc3e29a3f2 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006153718-8c6b3425d2db 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006142306-49a65cb9030e 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221006084412-8d26460f9d33 06 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.37.0-alpha.2.0.20221005193242-cfb87ab6f2e4 05 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221005191645-cdd3479f20b1 05 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221004194805-530da46f6183 04 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221004194211-55c682e4b3a2 04 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221004192111-61e473e744de 04 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221004155709-abbeb919dffd 04 Oct 2022 H1 M1 U1 Apache-2.0 Yes Details →
v0.34.21-0.20221004130132-a02cc30e4198 04 Oct 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20221004090303-5c23ffb05b8b 04 Oct 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20221003233619-6a3e360ae85e 03 Oct 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20221003090348-45518db3d07a 03 Oct 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220928140706-f76f6535b403 28 Sep 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20220927174211-66bd30ee47bc 27 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220927155122-20ffe9e101c4 27 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220926155852-af5281d704ca 26 Sep 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20220926155226-792998b779a1 26 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220923202655-ed68aadd2bde 23 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.22-0.20220923172207-dc6d73a408d7 23 Sep 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20220923141059-9dc3850f6b43 23 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220923135555-5fe1a7241672 23 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220922174236-0915836510ff 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220922104225-a0ed43794207 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220922084931-561440a56dc9 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20220922023516-3545d1e835e7 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.22-0.20220922023501-7e05d43b60f4 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.34.21-0.20220922012924-f1dc5811c334 22 Sep 2022 H1 M1 U1 — Yes Details →
v0.37.0-alpha.2.0.20220921172140-b9480d0ec79c 21 Sep 2022 H1 M1 U1 — Yes Details →

The newest 120 of 8,574 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 6
  • 2022 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 10 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/tendermint/tendermint

The 5 most severe of 10 vulnerabilities recorded for this package

Search all 10 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2019-25072: Uncontrolled Resource Consumption in Tendermint Client package 7.5 high 0.31.1 28 Dec 2022
CVE-2020-15091: Denial of Service in TenderMint 6.5 medium 0.33.6 20 Dec 2021
CVE-2021-21271: Uncontrolled Resource Consumption in Tendermint Core 6.5 medium 0.34.3 07 Oct 2022
CVE-2020-5303: Denial of Service in Tendermint p2p 3.1 low 0.33.3 27 May 2021
CVE-2020-15091: Denial of Service in TenderMint N/A unrated 0.34.0-dev1.0.20200702134149-480b995a3172 14 Apr 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/tendermint/tendermint

Is github.com/tendermint/tendermint safe to use?

Vulert records 10 vulnerabilities for github.com/tendermint/tendermint in Go: 0 critical, 1 high, 3 medium and 1 low, plus 5 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/tendermint/tendermint's Vulert package health score?

Vulert scores github.com/tendermint/tendermint 69/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/tendermint/tendermint affected?

Yes. v0.35.9, the version you would install today, has 3 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/tendermint/tendermint should I use?

v0.35.9 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/tendermint/tendermint have?

10 vulnerabilities are recorded for github.com/tendermint/tendermint in the Go ecosystem: 0 critical, 1 high, 3 medium and 1 low, plus 5 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/tendermint/tendermint vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/tendermint/tendermint in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/tendermint/tendermint are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/tendermint/tendermint for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/tendermint/tendermint version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.