Security Vulnerabilities - CVEs Published In 2024
In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification.
CVSS Score
6.5
EPSS Score
0.003
Published
2024-11-18
Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack) because a node does not first verify that a presented chain has enough work before committing to store it.
CVSS Score
7.5
EPSS Score
0.008
Published
2024-11-18
Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug.
CVSS Score
7.5
EPSS Score
0.005
Published
2024-11-18
In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.
CVSS Score
5.3
EPSS Score
0.004
Published
2024-11-18
In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.
CVSS Score
7.5
EPSS Score
0.005
Published
2024-11-18
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.
CVSS Score
7.5
EPSS Score
0.006
Published
2024-11-18
Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.
CVSS Score
7.5
EPSS Score
0.005
Published
2024-11-18
Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.
CVSS Score
6.5
EPSS Score
0.003
Published
2024-11-18
Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages.
CVSS Score
6.5
EPSS Score
0.003
Published
2024-11-18
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.
CVSS Score
7.5
EPSS Score
0.006
Published
2024-11-18