Critical Security Flaw in Bitcoin Core: Affects 17% of Nodes - Urgent Action Required

Bitcoin Core developers have issued a high-severity warning about a software bug impacting 17% of Bitcoin nodes. On Thursday, it was revealed that all versions prior to Bitcoin Core 24.0.1 are at risk. This denial-of-service bug could potentially crash nodes by overwhelming them with data.

Impact of the Bug

The vulnerability affects approximately 3,330 out of 19,200 reachable Bitcoin full nodes. Malicious actors can exploit this flaw by sending spammy header chains to nodes, forcing them to download excessively long chains that can overwhelm their bandwidth and storage capacity.

Developer Response

Developers patched this bug in pull request #25717, which was merged into production on December 12, 2022, with the release of v24.0.1. The current version of Bitcoin Core, now at 27.1, includes this fix along with others.

Nature of the Threat

While the bug is serious, there are currently few known exploits. The high cost of generating and broadcasting the header chains means that it is unlikely to be exploited for financial gain. However, it poses a risk if exploited by a wealthy or sophisticated actor, potentially for non-financial motives.

Transparency in Development

In June, Bitcoin Core developers committed to disclosing serious bugs that had been patched for at least 18 months. This recent disclosure highlights significant risks to software versions 24 and prior, including versions as recent as May 18, 2023. Without updates, 17% of the network remains vulnerable.

For more informed news, follow us on X, Instagram, Bluesky, and Google News.