CVE-2025-65548

Critical

Published: 08/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 does not validate the size of preimage when the token is spent. The preimage is stored by the mint and an attacker can exploit this to fill the mint's database and disk with arbitrary data.

Risk Assessment

An attacker can cause resource exhaustion of the system (database and disk), potentially leading to service disruption or denial of service for legitimate users.

Recommendation

Upgrade nutshell to version 0.18.0 or later to remediate the vulnerability.

Original NVD description (English source)

NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by the mint and attacker can exploit this vulnerability to fill the mint's db nd disk with arbitrary data.