Bitcoin vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-46597 Bitcoin Core 0.13.0 through 29.x has an integer overflow.High 7.5 · Mar 20, 2026
• CVE-2025-54605 Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).High 7.5 · Oct 28, 2025
• CVE-2025-54604 Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).High 7.5 · Oct 28, 2025
• CVE-2024-52920 Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.High 7.5 · Nov 17, 2024
• CVE-2024-52916 Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.High 7.5 · Nov 17, 2024
• CVE-2024-52915 Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.High 7.5 · Nov 17, 2024
• CVE-2024-52914 In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.High 7.5 · Nov 17, 2024
• CVE-2024-52912 Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an absHigh 7.5 · Nov 17, 2024
• CVE-2019-25220 Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width EHigh 7.5 · Nov 17, 2024
• CVE-2015-20111 miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and signiCritical 9.8 · Nov 17, 2024
• CVE-2024-35202 Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in aHigh 7.5 · Oct 10, 2024
• CVE-2023-37192 Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing High 7.5 · Jul 6, 2023
• CVE-2023-33297 Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-sHigh 7.5 · May 22, 2023
• CVE-2021-3401 Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to tCritical 9.8 · Feb 4, 2021
• CVE-2021-3195 bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call.High 7.5 · Jan 26, 2021
• CVE-2020-14198 Bitcoin Core 0.20.0 allows remote denial of service.High 7.5 · Sep 10, 2020
• CVE-2017-12842 Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did nHigh 7.5 · Mar 16, 2020
• CVE-2015-3641 bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" aHigh 7.5 · Mar 12, 2020
• CVE-2019-15947 In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory.High 7.5 · Sep 5, 2019
• CVE-2018-17144 Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial ofHigh 7.5 · Sep 19, 2018
• CVE-2016-10725 In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operationsHigh 7.5 · Jul 5, 2018
• CVE-2016-10724 Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker High 7.5 · Jul 5, 2018
• CVE-2017-9230 The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks folHigh 7.5 · May 24, 2017
• CVE-2013-2292 bitcoind and Bitcoin-Qt 0.8.0 and earlier allow remote attackers to cause a denial of service (electricity consumption) by mining a block to create a nonstandarHigh 7.8 · Mar 12, 2013
• CVE-2012-4684 The alert functionality in bitcoind and Bitcoin-Qt before 0.7.0 supports different character representations of the same signature data, but relies on a hash ofHigh 7.8 · Mar 12, 2013