Description
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
- https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
- https://invdos.netThird Party Advisory
- https://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory
- https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
- https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
- https://invdos.netThird Party Advisory
- https://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory
Timeline
- Published
- Sep 10, 2020
- Last modified
- Jun 17, 2026
- NVD status
- Modified