Developers have disclosed a high-severity bug involving spammy headers affecting old versions of Bitcoin Core node software.

Bitcoin Core developers have disclosed a high‑severity denial‑of‑service vulnerability affecting older versions of the software, warning that roughly 17% of reachable Bitcoin full nodes are still running code exposed to the bug. The issue exists in all Bitcoin Core releases prior to version 24.0.1, where an attacker can overwhelm nodes by sending large quantities of low‑difficulty header chains, potentially exhausting bandwidth or disk space and crashing the node. Surveillance data from Bitnodes cited in the disclosure estimates that about 3,330 of roughly 19,200 publicly reachable nodes are vulnerable under their self‑reported user agents. The bug was quietly fixed in pull request #25717 and released with Bitcoin Core v24.0.1 on December 12, 2022, and the current software series (up to v27.1) includes the mitigation. The vulnerability does not enable theft of funds or protocol rule changes; rather, it is a resource‑exhaustion / spam attack vector that could be used to selectively knock vulnerable nodes offline. According to Bitcoin Core’s security disclosure practices, such high‑severity bugs are typically kept private until a patched version has been available for some time, to give operators a chance to upgrade. While the attack is considered operationally serious, there are few publicly known instances of exploitation, in part because the attack is costly and offers limited direct financial upside to an adversary. However, the disclosure notes that a wealthy or state‑level actor might still find value in using it to degrade the resilience of the Bitcoin network for political or strategic reasons rather than immediate profit. The advisory reinforces long‑standing guidance for node operators to keep Bitcoin Core installations up to date, as recent disclosures have increasingly involved bugs affecting comparatively modern versions, including software released as late as May 2023. "entities":["Bitcoin Core","Bitcoin Core Project","Bitcoin full nodes","Bitnodes","Bitcoin network","Bitcoin Core v24.0.1","Bitcoin Core v27.1"]}`

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Bitcoin Core fixes high-severity node crash bug - Cybernews (cybernews.com)
• Bitcoin bug allowed miners to run code on other people's nodes (cryptonews.net)
• Bitcoin Core discloses high-severity bug A memory flaw - Binance (binance.com)
• Bitcoin Core Vulnerability Could Let BTC Miners Crash Nodes (bitcoinfoundation.org)
• Security Advisories - Bitcoin Core (bitcoincore.org)

Explore the topic

• Developers
• Bitcoin