CometBFT versions up to 0.37.15 and from 0.38.0-alpha.1 up to 0.38.18 contain a vulnerability in the handling of BitArray structures with mismatched element counts. This flaw can cause nodes to propagate invalid messages, potentially leading to a network halt rather than isolated node crashes. The issue has been fixed in versions 0.37.16 and 0.38.19. Validators, full nodes, and users running affected versions should upgrade to these fixed releases. As a temporary mitigation, nodes can ban malicious peers sending invalid payloads.