CVE-2021-31876: Medium severity bitcoin vulnerability
Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with nSequence = 0xffffffff, spending an unconfirmed parent with nSequence <= 0xfffffffd, should be replaceable because there is inherited signaling by the child transaction. However, the actual PreChecks implementation does not enforce this. Instead, mempool rejects the replacement attempt of the unconfirmed child transaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31876?
CVE-2021-31876 is considered a high severity vulnerability due to its potential to enable fund loss and denial of service attacks.
How do I fix CVE-2021-31876?
To fix CVE-2021-31876, it is recommended to upgrade to a version of Bitcoin Core later than 0.21.1.
What software versions are affected by CVE-2021-31876?
CVE-2021-31876 affects Bitcoin Core versions 0.12.0 to 0.21.1.
What impact does CVE-2021-31876 have on blockchain transactions?
CVE-2021-31876 can lead to a situation where attackers exploit transaction replacement policies, risking funds and affecting services like Lightning network nodes.
Is CVE-2021-31876 related to BIP125?
Yes, CVE-2021-31876 involves improper implementation of the replacement policy specified in BIP125.