CVE-2026-117346
Low risk· EPSS 10%Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Bitcoin Core through version 31.1 is vulnerable to a Denial of Service attack via undo files that have no size limit. The lack of size restriction may allow resource exhaustion and node destabilization.
Risk Assessment
Organizations using vulnerable Bitcoin Core versions may be exposed to denial-of-service attacks that can lead to node unavailability and network disruption.
Recommendation
Update Bitcoin Core to a version later than 31.1 (e.g., 31.2 or 32.1) to remove the Denial of Service vulnerability.
Other vulnerabilities in Bitcoin Core
See all- CVE-2026-117349Medium
Bitcoin Core prior to versions 29.5, 30.4, 31.2, and 32.1 is vulnerable to an out-of-memory (OOM) issue. The flaw can cause node malfunction due to insufficient memory resources.
- CVE-2026-117350Low risk· EPSS 6%
Bitcoin Core prior to 29.5, 30.4, 31.2, and 32.1 is vulnerable to an OOM (out-of-memory) issue. The description does not provide further technical details.
- CVE-2024-52911High
Bitcoin Core through version 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.
- CVE-2023-37192High
Memory management and protection issues in Bitcoin Core v22 allow attackers to modify the stored sending address within the app's memory, potentially enabling them to redirect Bitcoin transactions to wallets of their own choosing.
- CVE-2023-33297High
Bitcoin Core before version 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) due to inefficient draining of the inventory-to-send queue, as exploited in the wild in May 2023.
Original NVD description (English source)
Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit
Vulnerability data from NVD (NIST) · CISA KEV · EPSS