# Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

Source: https://junglewise.ai/threats/babylon-nil-blockhash-in-bls-vote-extensions-triggers-panics-in-18964830  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-08  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2025-12-08

Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

Technologies: [github.com/babylonlabs-io/babylon (Go)](https://junglewise.ai/threats/technologies/github-com-babylonlabs-io-babylon), [github.com/babylonlabs-io/babylon/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-babylonlabs-io-babylon-v2), [github.com/babylonlabs-io/babylon/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-babylonlabs-io-babylon-v3), [github.com/babylonlabs-io/babylon/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-babylonlabs-io-babylon-v4). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 8 December 2025.

**Which products and versions are affected?** github.com/babylonlabs-io/babylon (Go) SEMVER:introduced=0,last_affected=1.1.0; github.com/babylonlabs-io/babylon/v2 (Go) SEMVER:introduced=0,last_affected=2.3.2; github.com/babylonlabs-io/babylon/v3 (Go) SEMVER:introduced=0,last_affected=3.0.0-snapshot.250805a; github.com/babylonlabs-io/babylon/v4 (Go) SEMVER:introduced=0,fixed=4.2.0.

**Is there a fix for This vulnerability?** Yes. github.com/babylonlabs-io/babylon/v4 (Go): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run github.com/babylonlabs-io/babylon (Go), github.com/babylonlabs-io/babylon/v2 (Go), github.com/babylonlabs-io/babylon/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/babylonlabs-io/babylon/v4 (Go): upgrade to 4.2.0 or later

  ```sh
  go get github.com/babylonlabs-io/babylon/v4@v4.2.0
  ```


## Affected products

- github.com/babylonlabs-io/babylon (Go) SEMVER:introduced=0,last_affected=1.1.0
- github.com/babylonlabs-io/babylon/v2 (Go) SEMVER:introduced=0,last_affected=2.3.2
- github.com/babylonlabs-io/babylon/v3 (Go) SEMVER:introduced=0,last_affected=3.0.0-snapshot.250805a
- github.com/babylonlabs-io/babylon/v4 (Go) SEMVER:introduced=0,fixed=4.2.0

## Related threats

- [GO-2025-4214 - Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after…](https://junglewise.ai/threats/go-2025-4214-babylon-incorrect-fp-inactive-accounting-in-costaking-4edc5945)
- [GO-2025-4211 - Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in…](https://junglewise.ai/threats/go-2025-4211-babylon-nil-blockhash-in-bls-vote-extensions-triggers-ea870126)
- [Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond](https://junglewise.ai/threats/babylon-incorrect-fp-inactive-accounting-in-costaking-creates-phantom-6343d36e)
- [GO-2025-4159 - Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon](https://junglewise.ai/threats/go-2025-4159-babylon-s-bip322-signature-implementation-is-not-fully-7d25277b)
- [GO-2025-4157 - Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon](https://junglewise.ai/threats/go-2025-4157-babylon-s-malformed-vote-extensions-are-not-rejected-in-f4bf3eb1)