bitcoin core vulnerabilities and fixes

Recent CVEs affecting bitcoin core, with upgrade or downgrade steps. 17 tracked.

Also searched as: bitcoincore.

bitcoin core has 17 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-03-20. Highest priority: CVE-2024-35202 (score 46/100).

• CVE-2025-54605 HIGH 7.5 UPGRADE Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).
• CVE-2025-54604 HIGH 7.5 UPGRADE Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).
• CVE-2025-46598 MEDIUM 5.3 UPGRADE Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.
• CVE-2025-46597 HIGH 7.5 UPGRADE Bitcoin Core 0.13.0 through 29.x has an integer overflow.
• CVE-2024-55563 MEDIUM 5.3 UPGRADE Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue t
• CVE-2024-52922 MEDIUM 6.5 UPGRADE In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can
• CVE-2024-52921 MEDIUM 5.3 UPGRADE In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.
• CVE-2024-52920 HIGH 7.5 UPGRADE Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malforme
• CVE-2024-52919 MEDIUM 6.5 UPGRADE Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon
• CVE-2024-52917 MEDIUM 6.5 UPGRADE Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data
• CVE-2024-52916 HIGH 7.5 UPGRADE Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum di
• CVE-2024-52915 HIGH 7.5 UPGRADE Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a cra
• CVE-2024-52914 HIGH 7.5 UPGRADE In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unco
• CVE-2024-52913 MEDIUM 5.3 UPGRADE In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction
• CVE-2024-52912 HIGH 7.5 UPGRADE Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the
• CVE-2024-35202 HIGH 7.5 UPGRADE Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling asser
• CVE-2019-25220 HIGH 7.5 UPGRADE Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of

FAQ

How do I fix bitcoin core vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is bitcoin core being exploited right now?

None of the tracked bitcoin core CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which bitcoin core CVE should I patch first?

CVE-2024-35202 currently ranks highest (46/100): Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling asser.

RSS feed for bitcoin core · ← Back to latest CVEs