MAL-2026-17613 Malicious code in utxo-set-utils (RubyGems)

RubyGems runs this gem's native extension script ext/utxo-set-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in utxo-set-utils (RubyGems)

RubyGems runs this gem's native extension script ext/utxo-set-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-104426 Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...

CVE-2026-104426

Zebra versions before 6.1.0 are susceptible to an inefficient algorithmic complexity vulnerability (CWE-407) within the remaining_transaction_value function. The root cause is the cloning of the entire block-level spent-UTXO map for every transaction during contextual verification. This allows an...

PT-2026-104237

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining transaction value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input...

EUVD-2024-2237

Malicious code in bioql PyPI...

Applications of Zero-Knowledge Proofs on Bitcoin

This paper explores how zero-knowledge proofs can enhance Bitcoin's functionality and privacy. First, we consider Proof-of-Reserve schemes: by using zk-STARKs, a custodian can prove its Bitcoin holdings are more than a predefined threshold X, without revealing addresses or actual balances. We...

CVE-2023-21511

Out-of-bounds Read vulnerability while processing CMDCOLDWALLETBTCSETPRVUTXO in bccore trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory...

Malicious code in abstract-utxo (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-42448 Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed Close transaction, but no such check appears to be...

utxo-workshop 安全漏洞

utxo-workshop is a UTXO chain implementation on Substrate. utxo-workshop suffers from a security vulnerability that stems from the fact that an attacker can craft consensus messages, send them to various nodes and take them offline, and an attacker can use getaddr messages to crawl network peers...

MAL-2022-6872 Malicious code in utxo-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 537d19f0c3c8d33cd234a96a8ad34594f177451ab75f6655af683ace4dd6a9ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in utxo-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 537d19f0c3c8d33cd234a96a8ad34594f177451ab75f6655af683ace4dd6a9ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

bitcoin-core:utxo_snapshot: Use-of-uninitialized-value in crc32c::ExtendSse42

Detailed Report: https://oss-fuzz.com/testcase?key=5452735084888064 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: utxosnapshot Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: crc32c::ExtendSse42 crc32c::Exten...