CVE-2019-25220

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack) because a node does not first verify that a presented chain has enough work before committing to store it.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
bitcoin	bitcoin_core	< 24.0.1

References

https://bitcoincore.org/en/2024/09/18/disclose-headers-oomVendor Advisory
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_ExposuresThird Party Advisory
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-October/017354.htmlMailing List

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-252214.9The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and in CVE-2019-252224.9The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and includin CVE-2019-252234.9The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to,CVE-2019-252249.8The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vu CVE-2019-252256.1`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does no CVE-2019-252268.7Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_sys CVE-2019-252278.7Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management en CVE-2019-252285.3An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when CVE-2019-252298.8An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary f CVE-2019-25237.8Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-252304.3An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live si CVE-2019-252318.4devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged use