PT-2024-26378 · Unknown+1 · Bitcoin Core+1

Niklas Gögge · Published 2024-10-09 · Updated 2026-03-11 · CVE-2024-35202

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 25.0

Description A high-severity software bug in Bitcoin Core allows remote attackers to cause a denial of service by including transactions in a blocktxn message that are not committed to in a block's merkle root. This vulnerability affects over 13% of Bitcoin nodes worldwide, allowing attackers to remotely shut down nodes. The issue is related to the blocktxn message-handling logic, where an assertion can be triggered, leading to a node exit.

Recommendations To resolve the issue, update Bitcoin Core to version 25.0 or later. For nodes running versions prior to 25.0, upgrading to the latest version will mitigate the risk of remote shutdown attacks. As a temporary workaround, consider restricting access to the blocktxn message handling logic until a patch is applied.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2024-15200

CVE-2024-35202

Affected Products

Alt Linux

Bitcoin Core

References · 57

• https://nvd.nist.gov/vuln/detail/CVE-2024-35202 · Security Note
• https://bitcoincore.org/en/2024/10/08/disclose-blocktxn-crash · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35202 · Vendor Advisory
• https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-25.0.md · Note
• https://github.com/bitcoin/bitcoin/pull/26898 · Note
• https://github.com/bitcoin/bitcoin/releases/tag/v25.0 · Note
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures · Note
• https://twitter.com/alfabit_group/status/1845810419715178565 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1844538730419216658 · Twitter Post
• https://twitter.com/_ZoneCrypto_/status/1845683336913793194 · Twitter Post
• https://twitter.com/ItLunc/status/1844069396521611501 · Twitter Post
• https://twitter.com/base_gpt/status/1845416626205655389 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1845651586863042900 · Twitter Post
• https://twitter.com/EthereumPectra/status/1929843178418360431 · Twitter Post
• https://twitter.com/transilienceai/status/1845874393630785703 · Twitter Post