Vulnerabilities in pkg:golang/github.com/babylonlabs-io/babylon/v3
PACKAGEGHSA-m6wq-66p2-c8pc is a HIGH babylon nil blockhash vulnerability (CWE-476: NULL Pointer Dereference) affecting Github.com/babylonlabs io/babylon/v4 libraries in the Go ecosystem. The issue involves babylon nil blockhash in bls vote extensions triggers panics in consensus handlers. Remediation is available by upgrading affected packages to version 4.2.0.
pkg:golang/github.com/babylonlabs-io/babylon/v3
Vulnerability advisories affecting package pkg:golang/github.com/babylonlabs-io/babylon/v3. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-m6wq-66p2-c8pc | - | HIGH | Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers |
| GHSA-4rmq-mc2c-r495 | - | MODERATE | Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond |
GHSA-m6wq-66p2-c8pc at a Glance
How to Fix GHSA-m6wq-66p2-c8pc
To remediate this vulnerability, upgrade all affected Github.com/babylonlabs io/babylon/v4 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/babylonlabs-io/babylon/v4 to 4.2.0Upgrade github.com/babylonlabs-io/babylon/v3 to Latest secure releaseUpgrade github.com/babylonlabs-io/babylon/v2 to Latest secure releaseUpgrade github.com/babylonlabs-io/babylon to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/babylonlabs-io/babylon/v4How to Check if You Are Affected
To determine whether your application is affected by GHSA-m6wq-66p2-c8pc, inspect your project dependencies for Github.com/babylonlabs io/babylon/v4:
inspect dependencies for github.com/babylonlabs-io/babylon/v4Analyze the terminal output to locate any version of Github.com/babylonlabs io/babylon/v4 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-476: NULL Pointer Dereference, where the product dereferences a pointer that it expects to be valid but is null. In Github.com/babylonlabs io/babylon/v4, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-m6wq-66p2-c8pc Affected Github.com/babylonlabs io/babylon/v4 Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/babylonlabs-io/babylon/v4
|
Go |
< 4.2.0
|
4.2.0
|
|
github.com/babylonlabs-io/babylon/v3
|
Go |
≤ 3.0.0-snapshot.250805a
|
|
|
github.com/babylonlabs-io/babylon/v2
|
Go |
≤ 2.3.2
|
|
|
github.com/babylonlabs-io/babylon
|
Go |
≤ 1.1.0
|
|
References
Frequently Asked Questions
What is GHSA-m6wq-66p2-c8pc?
Which Github.com/babylonlabs io/babylon/v4 versions are affected?
What version fixes GHSA-m6wq-66p2-c8pc?
Is github.com/babylonlabs-io/babylon/v4 affected?
Is github.com/babylonlabs-io/babylon/v3 affected?
What CWE is associated with GHSA-m6wq-66p2-c8pc?
How can I check Go dependencies for GHSA-m6wq-66p2-c8pc?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m6wq-66p2-c8pc",
"modified" : "2025-12-17T01:09:11Z",
"published" : "2025-12-08T22:20:24Z",
"aliases" : [ ],
"summary" : "Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers",
"details" : "### Summary\n\nA vulnerability exists in Babylon’s BLS vote extension processing where a malicious active validator can submit a VoteExtension with the `block_hash` field omitted from the protobuf serialization. Because protobuf fields are optional, unmarshalling succeeds but leaves `BlockHash` as nil. Babylon then dereferences this nil pointer in consensus-critical code paths (notably `VerifyVoteExtension`, and also proposal-time vote verification), causing a runtime panic.\n\n### Impact\n\nIntermittent validator crashes at epoch boundaries, which would slow down the creation of the epoch boundary block.\n\n### Finder \n\nVulnerability discovered by:\n\n- @GrumpyLaurie55348",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v4"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.2.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "3.0.0-snapshot.250805a"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.3.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-m6wq-66p2-c8pc"
}, {
"type" : "WEB",
"url" : "https://github.com/babylonlabs-io/babylon/commit/f79ad58c1d5bcab3451cb7a47c91e713935917d7"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/babylonlabs-io/babylon"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-476" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-12-08T22:20:24Z",
"nvd_published_at" : null
}
}