CVE-2022-44797

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking...

Denial Of Service (DoS)

github.com/btcsuite/btcd is vulnerable to denial of service DoS. It is possible because the parseSig signature parsing function does not check the minimal message of size while checking the length of remaining message...

Downgrade Attack

github.com/btcsuite/btcd is vulnerable to downgrade attacks. The application doesn't enforce a TLS version, allowing a malicious user to conduct a protocol downgrade attack to a lower TLS version...

Denial Of Service

github.com/btcsuite/btcd is vulnerable to denial of service DoS attacks. A malicious user can cause the system to hang by sending multiple fake transactions because the system does not check if the transaction signature is valid...

Timing Attack

github.com/btcsuite/btcd is vulnerable to timing attacks. This vulnerability is caused because hashes are not compared in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...