Skip to content
SATWEI
Security notice

CVE-2024-52912 - Netsplit due to timestamp adjustment

Original on bitcoincore.org

Source
Bitcoin Corebitcoincore.org
Originally published
Original length
2 min read
Language
English

SATWEI summary

Two bugs in version message handling, a signed-integer overflow and an abs64 logic error, let an attacker skew a victim's adjusted time until it rejected new blocks as dated too far in the future. The attacker had to be among the first 200 peers to connect. Rated Medium, the flaw was fixed in Bitcoin Core 0.21.0.

Tags

  • CVE
  • P2P

More from Bitcoin Core

Network2 min read

Slow unbounded memory growth on paused pre-BIP31 peers

By pretending not to support BIP 31 pings, a malicious peer could dodge the 20-minute disconnect and read slowly, swelling a node's send queue by up to 2MB per hour for each inbound peer and 5MB for each outbound one. CVE-2026-117349, rated Medium, is fixed by #36667 in Bitcoin Core 32.1, 31.2, 30.4 and 29.5; -blocksonly nodes were much less exposed.

Bitcoin Core

Development1 min read

Bitcoin Core 30.4 released

Bitcoin Core 30.4 stops treating BIP 9 bits 5 to 28 as soft fork signals, following BIP 323, so blocks that set them no longer trigger unknown-deployment warnings (#34779). Network changes include a timeout enforced on paused send peers (#36667), and flatfile positions now use 64-bit integers (#36669).

Bitcoin Core

Development2 min read

Unbounded memory growth through TCP urgent data on non-Linux systems

Windows, macOS and BSD nodes could be crashed by a connected peer sending TCP urgent data, which slipped past paused reads in the select() backend and queued memory without limit (CVE-2026-117350). Linux nodes use poll() and are not affected. Bitcoin Core 32.1, 31.2, 30.4 and 29.5 fix the Medium-severity bug, which an LLM scan under Project Loupe found.

Bitcoin Core