BC
Product
Bitcoin Core
56
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 21Medium 12Low 0
Watch
Add Bitcoin Core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-46597 | 7.5 | Mar 20 | Bitcoin Core 0.13.0 through 29.x has an integer overflow Affected: 0.13.0 before 0.30.0 |
| CVE-2025-54605 | 7.5 | Oct 28 | Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2) Affected: before 30.0 |
| CVE-2025-54604 | 7.5 | Oct 28 | Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2) Affected: before 30.0 |
| CVE-2024-52912 | 7.5 | Nov 18 | Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug Affected: before 0.21.0 |
| CVE-2024-52920 | 7.5 | Nov 18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message Affected: before 0.20.0 |
| CVE-2024-52915 | 7.5 | Nov 18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message Affected: before 0.20.0 |
| CVE-2024-52914 | 7.5 | Nov 18 | In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction Affected: before 0.18.0 |
| CVE-2019-25220 | 7.5 | Nov 18 | Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack)… Affected: before 24.0.1 |
| CVE-2024-52916 | 7.5 | Nov 18 | Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers Affected: before 0.15.0 |
| CVE-2024-35202 | 7.5 | Oct 10 | Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message… Affected: before 25.0 |
| CVE-2023-37192 | 7.5 | Jul 7 | Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect… Affected: 22.0 |
| CVE-2023-33297 | 7.5 | May 22 | Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is… Affected: before 24.1 |
| CVE-2021-3195 | 7.5 | Jan 26 | bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call Affected: through 0.21.0 |
| CVE-2020-14198 | 7.5 | Sep 10 | Bitcoin Core 0.20.0 allows remote denial of service Affected: 0.20.0 |
| CVE-2018-17145 | 7.5 | Sep 10 | Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka… Affected: 0.16.0 before 0.16.2 |
| CVE-2017-12842 | 7.5 | Mar 16 | Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur Affected: before 0.14.0 |
| CVE-2015-3641 | 7.5 | Mar 12 | bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack Affected: before 0.10.2 |
| CVE-2019-15947 | 7.5 | Sep 5 | In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory Affected: 0.18.0 |
| CVE-2018-17144 | 7.5 | Sep 19 | Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service… Affected: 0.14.0 before 0.14.3; 0.15.0 before 0.15.2; 0.16.0 before 0.16.3 |
| CVE-2016-10725 | 7.5 | Jul 5 | In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong… Affected: before 0.13.0 |
| CVE-2016-10724 | 7.5 | Jul 5 | Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message… Affected: before 0.13.0 |
Showing 21