CVE-2019-25220: High severity bitcoin vulnerability
Published Nov 18, 2024
·Updated
Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack) because a node does not first verify that a presented chain has enough work before committing to store it.
Affected Software
2 affected components
Bitcoin Core<24.0.1
Bitcoin Bitcoin Core<24.0.1
Event History
Nov 18, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-25220?
CVE-2019-25220 is classified as a denial of service vulnerability.
2
How do I fix CVE-2019-25220?
To mitigate CVE-2019-25220, update Bitcoin Core to version 24.0.1 or later.
3
What causes the CVE-2019-25220 vulnerability?
CVE-2019-25220 is caused by insufficient verification of header chains, allowing attackers to trigger a daemon crash.
4
Who is affected by CVE-2019-25220?
CVE-2019-25220 affects users of Bitcoin Core versions prior to 24.0.1.
5
Can CVE-2019-25220 be exploited remotely?
Yes, CVE-2019-25220 can be exploited by remote attackers through a flood of low-difficulty header chains.