CVE-2024-52915

Bitcoin Core versions prior to 0.20.0 are vulnerable to a denial of service (DoS) attack. A remote attacker can trigger excessive memory consumption by sending a specially crafted INV message . To resolve this issue, it is recommended to update to version 0.20.0 or later. Exploitation details are...

CVE-2021-3195

Summary: CVE-2021-3195 affects Bitcoin Core (bitcoind) up to version 0.21.0, where a dumpwallet RPC call can create a new file in an arbitrary directory (e.g., outside ~/.bitcoin). This behavior is described as potentially violating the security model of forks with dumpwallet restrictions, though...

CVE-2019-15947

Bitcoin Core 0.18.0 stores wallet.dat data unencrypted in memory; on crash a core dump can enable an attacker to reconstruct wallet.dat with private keys by grepping for the sequence 6231 0500. Mitigation: upgrade to Bitcoin Core 0.20.x (e.g., 0.20.1) as advised by Mageia/Gentoo OSS advisories; n...

CVE-2018-17144

CVE-2018-17144 affects Bitcoin Core: versions 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3, plus Bitcoin Knots 0.14.x–0.16.x before 0.16.3. It allows a remote denial of service (application crash) via duplicate inputs exploited by miners, causing bitcoind/Bitcoin-Qt to cra...

CVE-2023-33297

Bitcoin Core versions prior to 24.1 are vulnerable to a denial of service (DoS) attack, specifically causing high CPU consumption . The root cause is an inefficient process when draining the inventory-to-send queue when debug mode is not active. This vulnerability was exploited in the wild in May...

CVE-2024-52919

Bitcoin Core versions prior to 22.0 are vulnerable to a CAddrMan nIdCount integer overflow caused by a flood of addr messages. This flaw triggers an assertion failure , leading to a daemon exit and a potential remote crash. To remediate, users should update to version 22.0 or later; for version 2...

CVE-2023-37192

Bitcoin Core (v22) is affected by a memory management/protection issue that allows an attacker to modify the stored sending address in the application’s memory, potentially redirecting transactions to wallets of the attacker’s choosing. The vulnerability concerns the core wallet handling path and...

CVE-2010-5139

CVE-2010-5139 describes an integer overflow in wxBitcoin and bitcoind up to version 0.3.11 that allows remote attackers to bypass economic restrictions and mint an unusually large number of bitcoins via a crafted Bitcoin transaction. Affected components are the Bitcoin reference client binaries s...

CVE-2024-35202

Bitcoin Core versions prior to 25.0 are vulnerable to a denial of service (DoS) attack. The root cause is an issue in the blocktxn message-handling where including transactions that are not committed to a block's merkle root causes a handling assertion failure and subsequent node exit. This occur...

CVE-2017-18350

Affected software: bitcoind and Bitcoin-Qt prior to 0.15.1. Issue: a stack-based buffer overflow caused by a signedness error when a attacker-controlled SOCKS proxy responds with an acknowledgement to an unexpected domain name. Impact details are consistent with the CVE, including a partial avail...

CVE-2018-20586

CVE-2018-20586 affects bitcoind and Bitcoin-Qt prior to 0.17.1, where an RPC call can inject arbitrary data into the debug log. Affected component: Bitcoin Core’s RPC/debug logging. Root cause: ability to write arbitrary data via RPC into logs. Impact: log contents could be polluted with attacker...

CVE-2024-52921

A security vulnerability exists in Bitcoin Core versions prior to 25.0 . A malicious peer can influence the download state of other peers by transmitting a mutated block , which can potentially disrupt the normal functioning of the Bitcoin network. To resolve this issue, users are recommended to ...

CVE-2023-50428

Affected software: Bitcoin Core up to 26.0 and Bitcoin Knots up to 25.1.knots20231115. Issue: datacarrier size limits can be bypassed by obfuscating data as code (e.g., OP_FALSE OP_IF). In the wild, this has been exploited by Inscriptions in 2022–2023. Impact: data-carrier limit bypass; potential...

CVE-2024-52917

Bitcoin Core versions prior to 22.0 are vulnerable to an infinite loop within the miniupnp component. The root cause is the allocation of memory based on random data received over the network, such as large M-SEARCH replies from a fake UPnP device. This vulnerability can lead to a Denial of Servi...

CVE-2024-52922

In Bitcoin Core versions prior to 25.1 , an attacker can cause a node to fail to download the latest block. The root cause is a delay of several minutes that occurs when an announcing peer stalls instead of adhering to the peer-to-peer protocol specification . To resolve this issue, users are rec...

CVE-2018-17145

CVE-2018-17145 affects Bitcoin Core 0.16.x prior to 0.16.2 and Bitcoin Knots 0.16.x prior to 0.16.2. The root cause is mishandling of inventory (inv) messages, allowing an attacker to cause remote denial of service by flooding with multiple transaction inv messages using random hashes. Impact des...

CVE-2015-3641

CVE-2015-3641 affects bitcoind and Bitcoin-Qt prior to 0.10.2, allowing a denial-of-service via an “Easy” attack (attackers could disable functionality or crash the client). Connected sources indicate the vulnerability is tied to older Bitcoin Core versions and that mitigation is to upgrade to ve...

CVE-2024-52912

Bitcoin Core versions prior to 0.21.0 are vulnerable to a network split caused by an integer overflow during time offset calculations for newly connecting peers, combined with an abs64 logic bug . To remediate this issue, users should update to version 0.21.0 or later . As a temporary workaround,...

CVE-2020-14198

CVE-2020-14198 affects Bitcoin Core 0.20.0, enabling remote denial of service. CVSSv3.1 metrics shown: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5, HIGH) and CVSSv2 base 5.0 (PARTIAL impact). Public references note the issue alongside CVE-2019-15947, with advisories recommending upgrading to a ...

CVE-2024-52920

Bitcoin Core versions prior to 0.20.0 are vulnerable to a denial of service (DoS) condition. A remote attacker can trigger an infinite loop by sending a malformed GETDATA message, which may lead to a node crash. To resolve this issue, users should upgrade to version 0.20.0 or later. As a temporar...

CVE-2013-2293

The CVE-2013-2293 issue affects bitcoind and Bitcoin-Qt prior to 0.8.0rc1. The CTransaction::FetchInputs function copies transactions from disk to memory without incrementally validating spent prevouts, enabling remote attackers to trigger a denial of service through a transaction with many input...

CVE-2017-12842

Bitcoin Core before 0.14 is vulnerable to an SPV proof manipulation flaw. An attacker can craft an ostensibly valid SPV proof for a payment to a victim’s SPV wallet even if the payment never occurred, potentially misleading the wallet into accepting non-existent transactions. The attack cost is d...

CVE-2024-52913

In Bitcoin Core versions prior to 0.21.0 , a vulnerability exists where an attacker can prevent a node from seeing a specific unconfirmed transaction. This is caused by the mishandling of transaction re-requests , which can lead to the omission of specific transactions from the node's view. A pro...

CVE-2024-52916

Bitcoin Core versions prior to 0.15.0 are vulnerable to a denial of service (DoS) attack. The root cause is the allocation of resources without limits or throttling , where an attacker can flood the software with minimum difficulty headers . This causes an out-of-memory (OOM) condition, resulting...

CVE-2019-25220

Bitcoin Core versions before 24.0.1 are vulnerable to a denial of service (daemon crash) due to a Chain Width Expansion attack. The root cause is that the node fails to verify if a presented chain has sufficient work before committing to store it, allowing a remote attacker to crash the service b...

CVE-2012-4684

CVE-2012-4684 affects Bitcoin Core (bitcoind/Bitcoin-Qt) prior to 0.7.0. The alert functionality accepts different character representations of the same signature data but relies on a hash of the signature, enabling a remote attacker to trigger a denial-of-service (resource consumption) by sendin...

CVE-2012-4683

Technical details for CVE-2012-4683 are not provided in the supplied documents. The connected records mention a generic DoS vulnerability in bitcoind/Bitcoin-Qt but lack specifics on affected versions, vectors, impact, or fixes. Monitor for updates.

CVE-2016-10724

CVE-2016-10724 affects Bitcoin Core before v0.13.0 (and related forks such as Bitcoin Knots before v0.13.0.knots20160814, plus many altcoins). The root cause is a memory-exhaustion denial-of-service vulnerability triggered by the remote network alert system, enabled if an attacker can sign a mess...

CVE-2024-55563

Bitcoin Core versions through 27.2 are vulnerable to a transaction-relay jamming attack via an off-chain protocol exploit. The root cause allows an attacker to flood transaction traffic, which prevents the propagation of specific Lightning channel transactions . A practical consequence of this vu...

CVE-2013-2292

CVE-2013-2292 affects bitcoind and Bitcoin-Qt 0.8.0 and earlier. The underlying issue is a DoS condition caused by mining a block that creates a nonstandard Bitcoin transaction containing multiple OP_CHECKSIG script opcodes. This block-level crafting can lead to electricity consumption as a conse...

CVE-2024-52914

Bitcoin Core versions prior to 0.18.0 are vulnerable to a denial of service (DoS) condition. A node can be stalled for hours when processing the orphans of a specially crafted unconfirmed transaction . The root cause is related to the allocation of resources without limits or throttling (CWE-770)...

CVE-2010-5141

The CVE-2010-5141 issue affects bitcoind and wxBitcoin up to version 0.3.4, with the root cause being improper handling of script opcodes in Bitcoin transactions. The vulnerability allows remote attackers to spend bitcoins owned by other users via unspecified vectors, as described in the provided...

CVE-2018-20587

CVE-2018-20587 affects Bitcoin Core (0.12.0–0.17.1) and Bitcoin Knots (0.12.0–0.17.x before 0.17.1.knots20181229). The root cause is Incorrect Access Control that lets local users bind the RPC IPv4 localhost port and forward requests to the IPv6 localhost port, enabling currency theft. The connec...

CVE-2013-2273

CVE-2013-2273 affects bitcoind/Bitcoin-Qt releases prior to specific 0.4.9rc1, 0.5.x prior to 0.5.8rc1, 0.6.x prior to 0.6.0.11rc1, 0.6.1–0.6.5 prior to 0.6.5rc1, and 0.7.x prior to 0.7.3rc1. The issue allows remote attackers to obtain potentially sensitive information about the transaction chang...

CVE-2013-3220

CVE-2013-3220 affects bitcoind/Bitcoin-Qt (and wxBitcoin) across multiple older branches, where blocks of large size could trigger excessive Berkeley DB locking. This allows remote DoS (split) and certain double-spending capabilities. Affected versions include pre-0.4.9rc2, pre-0.5.8rc2, pre-0.6....

CVE-2012-1910

CVE-2012-1910 affects Bitcoin-Qt versions: 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows. The root cause is that the projects did not use MinGW multithread-safe exception handling, allowing remote attackers to cause a denial of service (app...

CVE-2012-2459

CVE-2012-2459 affects bitcoind and Bitcoin-Qt across multiple early-release lines (before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2). The flaw allows remote attackers to cause a denial of service via unknown behavior on the Bitcoin network, leading to block-process...

CVE-2012-3789

CVE-2012-3789 affects bitcoind and Bitcoin-Qt before 0.4.7rc3, 0.5.x before 0.5.6rc3, 0.6.0.x before 0.6.0.9rc1, and 0.6.x before 0.6.3rc1, allowing remote attackers to cause a denial of service (process hang) on a Bitcoin network. Related advisories and vendor pages (Red Hat, Ubuntu, Debian) con...

CVE-2013-2272

The CVE-2013-2272 entry affects bitcoind and Bitcoin-Qt versions listed as vulnerable (before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1–0.6.5 before 0.6.5rc1, and 0.7.x before 0.7.3rc1) in the penny-flooding protection of CTxMemPool::accept. The issue allows remote attacker...

CVE-2013-3219

CVE-2013-3219 affects bitcoind/Bitcoin-Qt 0.8.x prior to 0.8.1. The root cause is failure to enforce a block protocol rule, enabling remote attackers to bypass access restrictions and attempt double-spending via a large block that triggers incorrect Berkeley DB locking in older builds. Remediatio...

CVE-2016-10725

In Bitcoin Core before v0.13.0, a non-final alert can block the final alert because operations occur in the wrong order. This affects the remote network alert system (deprecated since Q1 2016) and extends to other code paths such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins. Th...

CVE-2010-5138

CVE-2010-5138 affects wxBitcoin and bitcoind 0.3.x. A remote attacker can trigger a denial of service by submitting a Bitcoin transaction containing multiple OP_CHECKSIG script opcodes, leading to increased resource consumption and partial availability impact as stated in the NVD entry. Connected...

CVE-2013-5700

The CVE-2013-5700 issue affects the Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1. A crafted sequence of messages can trigger a division-by-zero error, leading to a denial of service and daemon crash. This is tied to the Bloom Filter component, with impact described...

CVE-2013-4165

CVE-2013-4165 affects bitcoind 0.8.1, where the HTTPAuthorized function in bitcoinrpc.cpp leaks timing information on the first incorrect password byte, enabling remote attackers to guess passwords via a timing side-channel. Impact: authenticated RPC password guessing vulnerability. Remediation: ...

CVE-2010-5137

The CVE-2010-5137 entry affects wxBitcoin and bitcoind prior to 0.3.5, where processing a Bitcoin transaction containing an OP_LSHIFT script opcode can trigger a daemon crash (DoS). The vulnerability is described consistently across multiple sources (Red Hat, Ubuntu, Debian security trackers, CVE...

CVE-2012-4682

Technical details for CVE-2012-4682 are not publicly provided in the supplied documents. No specifics on affected product/version/vectors. Monitor for updates from sources.

CVE-2010-5140

CVE-2010-5140 affects wxBitcoin and bitcoind prior to 0.3.13. The issue arises when handling bitcoins in transactions with zero confirmations, enabling a remote attacker to trigger a denial-of-service through an invalid-transaction flood by sending low-value transactions without fees. The describ...

CVE-2011-4447

The CVE-2011-4447 issue affects wxBitcoin and bitcoind, where the encrypt wallet feature fails to properly interact with BSDDB’s deletion logic. This allows context-dependent attackers to bypass the BSDDB interface and read entries marked for deletion, potentially exposing unencrypted private key...

CVE-2013-4627

CVE-2013-4627 applies to bitcoind and Bitcoin-Qt 0.8.x. The vulnerability allows remote attackers to cause a denial of service by sending a large amount of tx message data, resulting in memory consumption. A patch/update was released (Bitcoin-Qt 0.8.4) to fix this DoS issue and related vulnerabil...

CVE-2012-1909

CVE-2012-1909 affects the Bitcoin protocol implementations (e.g., bitcoind before 0.4.4, wxBitcoin, Bitcoin-Qt). The vulnerability arises from improper handling of multiple transactions sharing the same identifier, enabling remote attackers to trigger a denial of service by creating a duplicate c...