Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ava-labs/avalanchego

              master @ d8a8473
            

144

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Denial of Service: 77 prior fixes. Scrutinize any change in this area.

vms/platformvm: most-fixed (18 issues). Treat as high-risk during review.

91 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Cross-chain Warp message signatures were historically missing validation during critical block building and transaction execution paths, enabling potential verification bypasses. Implementing uniform validation is critical to prevent cross-chain state corruption.

Signature Bypass: Empty or invalid Warp BLS signatures could bypass cryptographic validation if they were not explicitly verified against canonical validator sets and source chain IDs. This allows replay and forgery vectors across network environments.

Denial of Service: The TLS handshake process was vulnerable to CPU exhaustion from overly large public keys and missing certificate constraints, allowing unauthenticated remote peers to stall nodes before handshakes completed.