{"id":"CVE-2019-25072","aliases":["GHSA-3fm3-m23v-5r46","GO-2020-0037"],"url":"https://o3.security/vulnerability/CVE-2019-25072","summary":"Tendermint Client package vulnerable to Uncontrolled Resource Consumption","details":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","published":"2022-12-27T22:15:11.323Z","modified":"2026-10-20T10:52:42.192477219Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/tendermint/tendermint","fixedVersion":"0.31.1"}],"fix":{"url":"https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613","label":"tendermint/tendermint@03085c2"},"references":[{"type":"ADVISORY","url":"https://github.com/tendermint/tendermint/pull/3430"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2020-0037"},{"type":"FIX","url":"https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25072"},{"type":"PACKAGE","url":"https://github.com/tendermint/tendermint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:52:42.192477219Z"}}