GHSA-c32p-wcqj-j677: CometBFT has inconsistencies between how commit signatures are verified and how block time is derived

Name: CSA-2026-001: Tachyon

Criticality: Critical (Catastrophic Impact; Possible Likelihood per ACMv1.2)

Affected versions: All versions of CometBFT

Affected users: Validators and protocols relying on block timestamps

A consensus-level vulnerability was discovered in CometBFT’s “BFT Time” implementation due to an inconsistency between how commit signatures are verified and how block time is derived.

This breaks a core BFT Time guarantee: “A faulty process cannot arbitrarily increase the Time value.”