CVE Daily – Bitcoin Core (High+Critical)

CVE Daily – Bitcoin Core (High+Critical) https://cvedaily.com/pages/tags/bitcoin-core.html CVE Daily – Bitcoin Core (High+Critical) en Wed, 03 Jun 2026 21:26:52 +0000 [High] CVE-2024-52911 – Bitcoin Core through 28.x has a security issue, the details of which are not dis... https://nvd.nist.gov/vuln/detail/CVE-2024-52911 https://nvd.nist.gov/vuln/detail/CVE-2024-52911 Tue, 05 May 2026 20:16:34 +0000 High CVE-2024-52911

Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.

CVSS: 7.5 · CWE: CWE-284

]]> [High] CVE-2025-46597 – Bitcoin Core 0.13.0 through 29.x has an integer overflow. https://nvd.nist.gov/vuln/detail/CVE-2025-46597 https://nvd.nist.gov/vuln/detail/CVE-2025-46597 Fri, 20 Mar 2026 16:16:16 +0000 High CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

CVSS: 7.5 · CWE: CWE-190

]]> [High] CVE-2025-54605 – Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2... https://nvd.nist.gov/vuln/detail/CVE-2025-54605 https://nvd.nist.gov/vuln/detail/CVE-2025-54605 Tue, 28 Oct 2025 17:15:37 +0000 High CVE-2025-54605

Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).

CVSS: 7.5 · CWE: CWE-400

]]> [High] CVE-2025-54604 – Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2... https://nvd.nist.gov/vuln/detail/CVE-2025-54604 https://nvd.nist.gov/vuln/detail/CVE-2025-54604 Tue, 28 Oct 2025 17:15:37 +0000 High CVE-2025-54604

Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).

CVSS: 7.5 · CWE: CWE-400

]]> [High] CVE-2024-52920 – Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service ... https://nvd.nist.gov/vuln/detail/CVE-2024-52920 https://nvd.nist.gov/vuln/detail/CVE-2024-52920 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2024-52920

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.

CVSS: 7.5 · CWE: CWE-770

]]> [High] CVE-2024-52916 – Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon proc... https://nvd.nist.gov/vuln/detail/CVE-2024-52916 https://nvd.nist.gov/vuln/detail/CVE-2024-52916 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2024-52916

Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.

CVSS: 7.5 · CWE: CWE-770

]]> [High] CVE-2024-52915 – Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service ... https://nvd.nist.gov/vuln/detail/CVE-2024-52915 https://nvd.nist.gov/vuln/detail/CVE-2024-52915 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2024-52915

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.

CVSS: 7.5 · CWE: CWE-770

]]> [High] CVE-2024-52914 – In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing... https://nvd.nist.gov/vuln/detail/CVE-2024-52914 https://nvd.nist.gov/vuln/detail/CVE-2024-52914 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2024-52914

In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.

CVSS: 7.5 · CWE: CWE-770

]]> [High] CVE-2024-52912 – Bitcoin Core before 0.21.0 allows a network split that is resultant from an inte... https://nvd.nist.gov/vuln/detail/CVE-2024-52912 https://nvd.nist.gov/vuln/detail/CVE-2024-52912 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2024-52912

Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug.

CVSS: 7.5 · CWE: CWE-190

]]> [High] CVE-2019-25220 – Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service ... https://nvd.nist.gov/vuln/detail/CVE-2019-25220 https://nvd.nist.gov/vuln/detail/CVE-2019-25220 Mon, 18 Nov 2024 04:15:04 +0000 High CVE-2019-25220

Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack) because a node does not first verify that a presented chain has enough work before committing to store it.

CVSS: 7.5 · CWE: CWE-770

]]> [Critical] CVE-2015-20111 – miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products,... https://nvd.nist.gov/vuln/detail/CVE-2015-20111 https://nvd.nist.gov/vuln/detail/CVE-2015-20111 Mon, 18 Nov 2024 04:15:03 +0000 Critical CVE-2015-20111

miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.

CVSS: 9.8 · CWE: CWE-120

]]> [High] CVE-2024-38365 – btcd is an alternative full node bitcoin implementation written in Go (golang). ... https://nvd.nist.gov/vuln/detail/CVE-2024-38365 https://nvd.nist.gov/vuln/detail/CVE-2024-38365 Fri, 11 Oct 2024 20:15:04 +0000 High CVE-2024-38365

btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consens…

CVSS: 7.4 · CWE: CWE-670

]]> [High] CVE-2024-35202 – Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (b... https://nvd.nist.gov/vuln/detail/CVE-2024-35202 https://nvd.nist.gov/vuln/detail/CVE-2024-35202 Thu, 10 Oct 2024 13:15:14 +0000 High CVE-2024-35202

Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance.

CVSS: 7.5 · CWE: CWE-770

]]> [High] CVE-2023-37192 – Memory management and protection issues in Bitcoin Core v22 allows attackers to ... https://nvd.nist.gov/vuln/detail/CVE-2023-37192 https://nvd.nist.gov/vuln/detail/CVE-2023-37192 Fri, 07 Jul 2023 00:15:10 +0000 High CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.

CVSS: 7.5 · CWE: CWE-311

]]> [High] CVE-2023-33297 – Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause... https://nvd.nist.gov/vuln/detail/CVE-2023-33297 https://nvd.nist.gov/vuln/detail/CVE-2023-33297 Mon, 22 May 2023 05:15:09 +0000 High CVE-2023-33297

Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.

CVSS: 7.5 · CWE: CWE-400

]]> [Critical] CVE-2021-3401 – Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary cod... https://nvd.nist.gov/vuln/detail/CVE-2021-3401 https://nvd.nist.gov/vuln/detail/CVE-2021-3401 Thu, 04 Feb 2021 05:15:13 +0000 Critical CVE-2021-3401

Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."

CVSS: 9.8 · CWE: CWE-88

]]> [High] CVE-2021-3195 – bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary di... https://nvd.nist.gov/vuln/detail/CVE-2021-3195 https://nvd.nist.gov/vuln/detail/CVE-2021-3195 Tue, 26 Jan 2021 18:16:28 +0000 High CVE-2021-3195

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions

CVSS: 7.5 · CWE: CWE-20

]]> [High] CVE-2020-14198 – Bitcoin Core 0.20.0 allows remote denial of service. https://nvd.nist.gov/vuln/detail/CVE-2020-14198 https://nvd.nist.gov/vuln/detail/CVE-2020-14198 Thu, 10 Sep 2020 17:15:28 +0000 High CVE-2020-14198

Bitcoin Core 0.20.0 allows remote denial of service.

CVSS: 7.5 · CWE: N/A

]]> [High] CVE-2018-17145 – Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow r... https://nvd.nist.gov/vuln/detail/CVE-2018-17145 https://nvd.nist.gov/vuln/detail/CVE-2018-17145 Thu, 10 Sep 2020 17:15:25 +0000 High CVE-2018-17145

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.

CVSS: 7.5 · CWE: CWE-400

]]> [High] CVE-2017-12842 – Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV pr... https://nvd.nist.gov/vuln/detail/CVE-2017-12842 https://nvd.nist.gov/vuln/detail/CVE-2017-12842 Mon, 16 Mar 2020 20:15:12 +0000 High CVE-2017-12842

Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount.

CVSS: 7.5 · CWE: CWE-20

]]> [High] CVE-2019-15947 – In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory... https://nvd.nist.gov/vuln/detail/CVE-2019-15947 https://nvd.nist.gov/vuln/detail/CVE-2019-15947 Thu, 05 Sep 2019 17:15:12 +0000 High CVE-2019-15947

In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file, an attacker can reconstruct the user's wallet.dat file, including their private keys, via a grep "6231 0500" command.

CVSS: 7.5 · CWE: CWE-312

]]> [High] CVE-2018-17144 – Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16... https://nvd.nist.gov/vuln/detail/CVE-2018-17144 https://nvd.nist.gov/vuln/detail/CVE-2018-17144 Wed, 19 Sep 2018 08:29:00 +0000 High CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.

CVSS: 7.5 · CWE: N/A

]]> [High] CVE-2016-10725 – In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "... https://nvd.nist.gov/vuln/detail/CVE-2016-10725 https://nvd.nist.gov/vuln/detail/CVE-2016-10725 Thu, 05 Jul 2018 22:29:00 +0000 High CVE-2016-10725

In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

CVSS: 7.5 · CWE: CWE-310

]]> [High] CVE-2016-10724 – Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) trigger... https://nvd.nist.gov/vuln/detail/CVE-2016-10724 https://nvd.nist.gov/vuln/detail/CVE-2016-10724 Thu, 05 Jul 2018 22:29:00 +0000 High CVE-2016-10724

Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

CVSS: 7.5 · CWE: CWE-400

]]>