CVE-2018-17145

PoC —

CVSS 3.1

7.5 high

EPSS

4%p90

Published

Sep 10, 2020 (Sep 10, 2020)

Modified

Jun 17, 2026

Description

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.

Vendors: bcoin bitcoin bitcoinknots btcd project decred litecoin namecoin
Products: bcoin, bitcoin core, bitcoin knots, btcd, dcrd, litecoin, namecoin core
Weakness: CWE-400
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news1 stories

INVDoS, a DoS issue in Bitcoin core remained undisclosed for two years

Security AffairsSep 12, 14:18 UTC · Sep 12, 2020Exploit / PoC CVE-2018-17145