PT-2025-49415 · Nutshell · Nutshell

Published 2025-12-07 · Updated 2026-05-29 · CVE-2025-65548

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions nutshell (cashubtc/nuts) versions prior to 0.18.0

Description NUT-14 allows cashu tokens to be created using a preimage hash. In affected versions, the software fails to validate the size of the preimage when a token is spent. Because the mint stores this preimage, an attacker can exploit this lack of validation to fill the mint's database and disk with arbitrary data.

Recommendations Update to version 0.18.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2025-65548

PYSEC-2025-89

Affected Products

Nutshell

References · 16

• 🔥 https://github.com/cashubtc/nuts/blob/main/07.md · Exploit
• 🔥 https://github.com/cashubtc/nuts/blob/main/14.md · Exploit
• 🔥 https://github.com/jamesob/delving-bitcoin-archive/blob/master/archive/rendered-topics/2025-11-November/2025-11-02-public-disclosure-denial-of-service-using-htlc-in-cashu-id2090.md · Exploit
• 🔥 https://bitcointalk.org/index.php?topic=5564329 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65548 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-89 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65548 · Vendor Advisory
• https://twitter.com/1440000bytes/status/2060210275182379078 · Twitter Post
• https://t.me/cveNotify/145253 · Telegram Post
• https://twitter.com/1440000bytes/status/1997657676713472342 · Twitter Post
• https://delvingbitcoin.org/t/public-disclosure-denial-of-service-using-htlc-in-cashu/2090 · Note
• https://twitter.com/1440000bytes/status/1998128722864734641 · Twitter Post
• https://preimage007.github.io · Note
• https://twitter.com/CVEnew/status/1998099352724832310 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998152126338404810 · Twitter Post