CVE-2015-20111

miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in...

CVE-2024-52921

In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block...

CVE-2024-52916

Summary (CVE-2024-52916) : Bitcoin Core versions prior to 0.15.0 are affected by a denial-of-service condition caused by a flood of minimum-difficulty headers, which can lead to an out-of-memory (OOM) exhaustion of the daemon. This impacts availability of the Bitcoin Core node. Remediation: upgra...

CVE-2024-52921

CVE-2024-52921 affects Bitcoin Core prior to 25.0. A peer can alter the download state of other peers by sending a mutated block, potentially disrupting block propagation and peer synchronization. Affected component: Bitcoin Core networking/block processing; root cause: processing of malformed/mu...

CVE-2024-52918

CVE-2024-52918 affects Bitcoin Core prior to 0.20.0, specifically Bitcoin-Qt. The vulnerability arises from processing a BIP21 r parameter in a URL that contains a large file, which can trigger memory consumption leading to a denial of service and application crash. Multiple connected sources (NV...

CVE-2024-52915

CVE-2024-52915 affects Bitcoin Core before 0.20.0. The issue allows remote attackers to cause a denial-of-service via a crafted INV message that triggers memory consumption. Affected versions are prior to 0.20.0; remediation is to upgrade to version 0.20.0 or later. Public documents in the provid...

CVE-2024-52914

CVE-2024-52914 affects Bitcoin Core, prior to version 0.18.0. The issue causes a node to be stalled for hours when processing the orphans of a crafted unconfirmed transaction. The available documents state the vulnerability and its impact (long stall), but do not provide exploit details, affected...

CVE-2015-20111

CVE-2015-20111 affects MiniUPnP/miniupnp (and downstreams such as Bitcoin Core before v0.12) where the code does not check snprintf return values, causing a buffer overflow and a data leak. Affected component is the UPnP daemon (miniupnpd) and related miniupnp code prior to the commit 4c90b87; th...

CVE-2024-52920

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service infinite loop via a malformed GETDATA message...

CVE-2024-52913

In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled...

CVE-2024-52919

Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure and daemon exit via a flood of addr messages...

CVE-2024-52922

In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification...

CVE-2024-52914

In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction...

CVE-2024-52921

In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block...

CVE-2024-52917

Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device...

PT-2024-10566 · Bitcoin · Bitcoin Core

🚨 CVE-2015-20111 miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was...

CVE-2024-52912

Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow calculating the time offset for newly connecting peers and an abs64 logic bug...

CVE-2024-52912

Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow calculating the time offset for newly connecting peers and an abs64 logic bug...

PT-2024-35480 · Unknown · Bitcoin Core

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.21.0 Description: The issue arises from an integer overflow when calculating the time offset for newly connecting peers, combined with an abs64 logic bug. This can lead to a network split. Recommendations: For...

PT-2024-35485 · Unknown · Bitcoin Core

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 22.0 Description: The issue is related to an infinite loop in the miniupnp component, where memory is allocated based on random data received over the network, such as large M-SEARCH replies from a fake UPnP...