Vulnerabilites related to btcd_project - btcd
Vulnerability from fkie_nvd
Published
2022-11-07 04:15
Modified
2025-05-01 18:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
References
cve@mitre.orghttps://github.com/btcsuite/btcd/pull/1896Patch, Third Party Advisory
cve@mitre.orghttps://github.com/btcsuite/btcd/releases/tag/v0.23.2Release Notes, Third Party Advisory
cve@mitre.orghttps://github.com/lightningnetwork/lnd/issues/7002Exploit, Issue Tracking, Third Party Advisory
cve@mitre.orghttps://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-betaRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/btcsuite/btcd/pull/1896Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/btcsuite/btcd/releases/tag/v0.23.2Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/issues/7002Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-betaRelease Notes, Third Party Advisory
Impacted products
Vendor Product Version
btcd_project btcd *
lightning_network_daemon_project lightning_network_daemon *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E378CBBF-D617-43FF-B5C4-E3A0204F1039",
              "versionEndExcluding": "0.23.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "549EFCEE-BB9C-4E12-9C15-BDBCF9A1792B",
              "versionEndExcluding": "0.15.2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking."
    },
    {
      "lang": "es",
      "value": "btcd anterior a 0.23.2, como se usa en Lightning Labs lnd anterior a 0.15.2-beta y otros productos relacionados con Bitcoin, maneja mal la verificaci\u00f3n del tama\u00f1o de los testigos."
    }
  ],
  "id": "CVE-2022-44797",
  "lastModified": "2025-05-01T18:15:51.430",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-11-07T04:15:09.650",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/btcsuite/btcd/pull/1896"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/btcsuite/btcd/releases/tag/v0.23.2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/issues/7002"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/btcsuite/btcd/pull/1896"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/btcsuite/btcd/releases/tag/v0.23.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/issues/7002"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2024-10-11 20:15
Modified
2025-08-20 19:23
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.
References
security-advisories@github.comhttps://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184Issue Tracking
security-advisories@github.comhttps://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5Patch
security-advisories@github.comhttps://github.com/btcsuite/btcd/releases/tag/v0.24.2Release Notes
security-advisories@github.comhttps://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8Vendor Advisory
Impacted products
Vendor Product Version
btcd_project btcd *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "174235E7-7C71-4299-B871-30D15F9FBECE",
              "versionEndExcluding": "0.24.2",
              "versionStartIncluding": "0.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "btcd es una implementaci\u00f3n alternativa de nodo completo de bitcoin escrita en Go (golang). El cliente de Bitcoin btcd (versiones 0.10 a 0.24) no volvi\u00f3 a implementar correctamente la funcionalidad \"FindAndDelete()\" de Bitcoin Core. Esta l\u00f3gica es cr\u00edtica para el consenso: la diferencia de comportamiento con los otros clientes de Bitcoin puede llevar a que los clientes de btcd acepten un bloque de Bitcoin no v\u00e1lido (o rechacen uno v\u00e1lido). Esta falla de consenso se puede aprovechar para causar una divisi\u00f3n de la cadena (aceptando un bloque de Bitcoin no v\u00e1lido) o se puede explotar para atacar los nodos de btcd (rechazando un bloque de Bitcoin v\u00e1lido). Un atacante puede crear una transacci\u00f3n est\u00e1ndar donde FindAndDelete no devuelva una coincidencia pero removeOpCodeByData s\u00ed, lo que hace que btcd obtenga un signo diferente, lo que lleva a una divisi\u00f3n de la cadena. Es importante destacar que esta vulnerabilidad puede ser explotada de forma remota por cualquier usuario de Bitcoin y no requiere ning\u00fan poder de hash. Esto se debe a que la diferencia en el comportamiento puede ser provocada por una transacci\u00f3n \"est\u00e1ndar\" de Bitcoin, es decir, una transacci\u00f3n que se retransmite a trav\u00e9s de la red P2P antes de que se incluya en un bloque de Bitcoin. `removeOpcodeByData(script []byte, dataToRemove []byte)` elimina cualquier env\u00edo de datos de `script` que contenga `dataToRemove`. Sin embargo, `FindAndDelete` solo elimina las coincidencias exactas. Entonces, por ejemplo, con `script = \" \"` y `dataToRemove = \"data\"` btcd eliminar\u00e1 ambos env\u00edos de datos, pero `FindAndDelete` de Bitcoin Core solo elimina el primer env\u00edo ``. Esto se ha corregido en la versi\u00f3n v0.24.2 de btcd. Se recomienda a los usuarios que actualicen. No hay workarounds para este problema."
    }
  ],
  "id": "CVE-2024-38365",
  "lastModified": "2025-08-20T19:23:36.953",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-11T20:15:04.733",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-11-17 22:15
Modified
2024-11-21 07:18
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Summary
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.
References
security-advisories@github.comhttps://github.com/lightningnetwork/lnd/issues/7096Exploit, Issue Tracking, Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/lightningnetwork/lnd/pull/7098Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-betaRelease Notes, Third Party Advisory
security-advisories@github.comhttps://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83prThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/issues/7096Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/pull/7098Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-betaRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83prThird Party Advisory
Impacted products
Vendor Product Version
btcd_project btcd *
lightning_network_daemon_project lightning_network_daemon *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C76213E-2BE3-4BF3-B5D1-2AA9B6BB0A95",
              "versionEndExcluding": "0.23.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4F9DC3C-AC0A-472A-B74E-2966F1B7D3A9",
              "versionEndExcluding": "0.15.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present."
    },
    {
      "lang": "es",
      "value": "Lightning Network Daemon (lnd) es una implementaci\u00f3n de un nodo de red superpuesto de bitcoin rel\u00e1mpago. Todos los nodos lnd anteriores a la versi\u00f3n `v0.15.4` son vulnerables a un error de an\u00e1lisis de bloques que puede hacer que un nodo entre en un estado degradado una vez encontrado. En este estado degradado, los nodos pueden continuar realizando pagos y reenviando HTLC y cerrar canales. Est\u00e1 prohibido abrir canales y tampoco se detectar\u00e1n eventos de transacciones en cadena. Esto puede provocar la p\u00e9rdida de fondos si se investiga el vencimiento de un CSV durante un intento de infracci\u00f3n o si un delta de CLTV expira olvid\u00e1ndose de los fondos en el HTLC. Hay un parche disponible en la versi\u00f3n 0.15.4 de `lnd`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden usar la llamada RPC `lncli updatechanpolicy` para aumentar su valor CLTV a una cantidad muy alta o aumentar sus pol\u00edticas de tarifas. Esto evitar\u00e1 que los nodos se enruten a trav\u00e9s de su nodo, lo que significa que no puede haber ning\u00fan HTLC pendiente."
    }
  ],
  "id": "CVE-2022-39389",
  "lastModified": "2024-11-21T07:18:11.677",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-11-17T22:15:10.547",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/issues/7096"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/pull/7098"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/issues/7096"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/pull/7098"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2024-05-05 01:15
Modified
2025-08-21 15:42
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
References
cve@mitre.orghttps://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455Issue Tracking
cve@mitre.orghttps://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3Product
cve@mitre.orghttps://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3Product
af854a3a-2127-422b-91ae-364da2661108https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3Product
af854a3a-2127-422b-91ae-364da2661108https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3Product
Impacted products
Vendor Product Version
btcd_project btcd *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1A28966-956A-4EF6-B2B3-FF6B74BB2B97",
              "versionEndExcluding": "0.24.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds."
    },
    {
      "lang": "es",
      "value": "btcd anterior a 0.24.0 no implementa correctamente las reglas de consenso descritas en BIP 68 y BIP 112, lo que lo hace susceptible a fallas de consenso. Espec\u00edficamente, utiliza la versi\u00f3n de la transacci\u00f3n como un entero con signo cuando se supone que debe tratarse como sin signo. Puede haber una divisi\u00f3n de la cadena y una p\u00e9rdida de fondos."
    }
  ],
  "id": "CVE-2024-34478",
  "lastModified": "2025-08-21T15:42:23.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-05T01:15:06.320",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-09-10 17:15
Modified
2024-11-21 03:53
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
References
cve@mitre.orghttps://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
cve@mitre.orghttps://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
cve@mitre.orghttps://invdos.netThird Party Advisory
cve@mitre.orghttps://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://invdos.netThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory
Impacted products
Vendor Product Version
bcoin bcoin *
bitcoin bitcoin_core *
bitcoinknots bitcoin_knots *
btcd_project btcd 0.3.0
btcd_project btcd 0.3.1
btcd_project btcd 0.3.2
btcd_project btcd 0.3.3
btcd_project btcd 0.4.0
btcd_project btcd 0.5.0
btcd_project btcd 0.6.0
btcd_project btcd 0.7.0
btcd_project btcd 0.8.0
btcd_project btcd 0.9.0
btcd_project btcd 0.10.0
btcd_project btcd 0.11.0
btcd_project btcd 0.11.1
btcd_project btcd 0.12.0
btcd_project btcd 0.13.0
btcd_project btcd 0.13.0
btcd_project btcd 0.20.0
btcd_project btcd 0.20.1
decred dcrd *
litecoin litecoin *
namecoin namecoin_core *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bcoin:bcoin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D47D52B-8C16-4A9C-ADFC-92B0C8C4C7E2",
              "versionEndExcluding": "1.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bitcoin:bitcoin_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "54E8DE3C-5E58-4BAB-8C28-EC7CF9749B0B",
              "versionEndExcluding": "0.16.2",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bitcoinknots:bitcoin_knots:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BD003E0-D891-4340-9818-7231219F72B0",
              "versionEndExcluding": "0.16.2",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.3.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "F24D4ED2-623F-44E4-9BE7-E8F4004A26B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.3.1:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "DFA56887-43B2-4831-883C-D4E9C3B2AD2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.3.2:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "8701A58C-A87A-42DD-B841-960246BE486A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.3.3:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "6B066ACB-83C2-4678-AFAA-0C1A9AA592E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.4.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "C036F3F2-A5ED-47BA-B98C-08788C8E390B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.5.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "CB365F56-5FD5-4C2C-9E37-0352A981C427",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.6.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "F02ECCBD-18C8-4CF9-9611-55454506EA8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.7.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "81BA7357-679A-4950-A38F-56E4423339FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.8.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "117660E8-0A79-4558-88C6-00B96C896967",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.9.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "82BC5866-F639-47E1-A083-F383A9E40E18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.10.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "CB7F92D5-42D4-4EFD-929A-15ADC79A79CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.11.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "E386CD33-130A-4064-8112-4B492E7A437F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.11.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "4F0976B7-1D89-41A3-AA8C-035A0646B3FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.12.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6FFE3B5E-B0FD-469E-AFB6-E5E77964ED4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.13.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "5D6EBD54-5A03-4022-BE66-D3F380CAFADD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.13.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "08F558B9-DAD3-47B0-A56B-F574CAC36CF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.20.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "00C62A96-3EBC-4FA4-8BF1-718F5E6B3A91",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:btcd_project:btcd:0.20.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "029A3CB7-0076-4908-9EA7-127F549739A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:decred:dcrd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "257D3613-4A8C-4C78-A219-85793EE29132",
              "versionEndExcluding": "1.5.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:litecoin:litecoin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "265C6B30-51DA-45FD-9637-7BA9DFDD27AB",
              "versionEndExcluding": "0.16.2",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:namecoin:namecoin_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "30BE44E8-2ADB-4F7B-855E-9539AD459278",
              "versionEndExcluding": "0.16.2",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15."
    },
    {
      "lang": "es",
      "value": "Bitcoin Core versiones 0.16.x anteriores a 0.16.2 y Bitcoin Knots versiones 0.16.x anteriores a 0.16.2, permite la denegaci\u00f3n de servicio remota por medio de una avalancha de mensajes inv de transacciones m\u00faltiples con hashes aleatorios, tambi\u00e9n se conoce como INVDoS. NOTA: esto tambi\u00e9n puede afectar a otras criptomonedas, por ejemplo, si se bifurcaron desde Bitcoin Core despu\u00e9s del 15/11/2017"
    }
  ],
  "id": "CVE-2018-17145",
  "lastModified": "2024-11-21T03:53:57.297",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-10T17:15:25.767",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://invdos.net"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://invdos.net/paper/CVE-2018-17145.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://invdos.net"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://invdos.net/paper/CVE-2018-17145.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-38365 (GCVE-0-2024-38365)
Vulnerability from cvelistv5
Published
2024-10-11 19:32
Modified
2024-10-11 19:48
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Summary
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.
References
Impacted products
Vendor Product Version
btcsuite btcd Version: >= 0.10.0, < 0.24.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38365",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-11T19:46:36.694476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-11T19:48:30.393Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "btcd",
          "vendor": "btcsuite",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.10.0, \u003c 0.24.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670: Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-11T19:32:12.348Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
        },
        {
          "name": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
        },
        {
          "name": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
        },
        {
          "name": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
        }
      ],
      "source": {
        "advisory": "GHSA-27vh-h6mc-q6g8",
        "discovery": "UNKNOWN"
      },
      "title": "btcd did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-38365",
    "datePublished": "2024-10-11T19:32:12.348Z",
    "dateReserved": "2024-06-14T14:16:16.465Z",
    "dateUpdated": "2024-10-11T19:48:30.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-34478 (GCVE-0-2024-34478)
Vulnerability from cvelistv5
Published
2024-05-05 00:00
Modified
2024-08-07 15:03
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • n/a
Summary
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:51:11.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:btcd:btcd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "btcd",
            "vendor": "btcd",
            "versions": [
              {
                "lessThan": "0.24.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T15:43:21.900167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-436",
                "description": "CWE-436 Interpretation Conflict",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:03:11.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-05T00:23:18.318264",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455"
        },
        {
          "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3"
        },
        {
          "url": "https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-34478",
    "datePublished": "2024-05-05T00:00:00",
    "dateReserved": "2024-05-05T00:00:00",
    "dateUpdated": "2024-08-07T15:03:11.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-44797 (GCVE-0-2022-44797)
Vulnerability from cvelistv5
Published
2022-11-07 00:00
Modified
2025-05-01 17:38
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Summary
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:01:31.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/issues/7002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/btcsuite/btcd/pull/1896"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/btcsuite/btcd/releases/tag/v0.23.2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-44797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T17:35:55.993310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-01T17:38:04.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-07T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/lightningnetwork/lnd/issues/7002"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta"
        },
        {
          "url": "https://github.com/btcsuite/btcd/pull/1896"
        },
        {
          "url": "https://github.com/btcsuite/btcd/releases/tag/v0.23.2"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-44797",
    "datePublished": "2022-11-07T00:00:00.000Z",
    "dateReserved": "2022-11-07T00:00:00.000Z",
    "dateUpdated": "2025-05-01T17:38:04.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-39389 (GCVE-0-2022-39389)
Vulnerability from cvelistv5
Published
2022-11-17 00:00
Modified
2025-04-22 16:07
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE
  • CWE-20 - Improper Input Validation
Summary
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.
References
Impacted products
Vendor Product Version
lightningnetwork lnd Version: < v0.15.4-beta
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:07:41.957Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/issues/7096"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/pull/7098"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39389",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:39:14.564355Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T16:07:33.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lnd",
          "vendor": "lightningnetwork",
          "versions": [
            {
              "status": "affected",
              "version": " \u003c v0.15.4-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-17T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/issues/7096"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/pull/7098"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
        }
      ],
      "source": {
        "advisory": "GHSA-hc82-w9v8-83pr",
        "discovery": "UNKNOWN"
      },
      "title": "Witness Block Parsing DoS Vulnerability in lnd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39389",
    "datePublished": "2022-11-17T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-22T16:07:33.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-17145 (GCVE-0-2018-17145)
Vulnerability from cvelistv5
Published
2020-09-10 16:32
Modified
2024-08-05 10:39
Severity ?
CWE
  • n/a
Summary
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:39:59.568Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://invdos.net/paper/CVE-2018-17145.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://invdos.net"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-10T16:32:13",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://invdos.net/paper/CVE-2018-17145.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://invdos.net"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-17145",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md",
              "refsource": "MISC",
              "url": "https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md"
            },
            {
              "name": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145",
              "refsource": "MISC",
              "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145"
            },
            {
              "name": "https://invdos.net/paper/CVE-2018-17145.pdf",
              "refsource": "CONFIRM",
              "url": "https://invdos.net/paper/CVE-2018-17145.pdf"
            },
            {
              "name": "https://invdos.net",
              "refsource": "CONFIRM",
              "url": "https://invdos.net"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-17145",
    "datePublished": "2020-09-10T16:32:13",
    "dateReserved": "2018-09-18T00:00:00",
    "dateUpdated": "2024-08-05T10:39:59.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}