GHSA-2fcv-qww3-9v6h: Babylon's malformed vote extensions are not rejected

November 24, 2025 (updated November 27, 2025)

Adversarial validators can send large vote extensions by using non-existing protobuf tags. This will result in the rejection of the subsequent block proposal. Eventually, all block proposals will be rejected by all validators.

References

github.com/advisories/GHSA-2fcv-qww3-9v6h
github.com/babylonlabs-io/babylon
github.com/babylonlabs-io/babylon/pull/1873/commits/86f38abd2dca5a656195a9954bb569a08d662e2b
github.com/babylonlabs-io/babylon/releases/tag/v4.1.0
github.com/babylonlabs-io/babylon/security/advisories/GHSA-2fcv-qww3-9v6h

Code Behaviors & Features

Detect and mitigate GHSA-2fcv-qww3-9v6h with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →