- Source
- Bitcoin Corebitcoincore.org
- Originally published
- Original length
- 4 min read
- Language
- English
SATWEI summary
Beyond the crash already made public, CVE-2018-17144 let a miner inflate the Bitcoin supply in versions 0.15.X to 0.16.2 by spending an output twice inside one transaction. Developers held back that part to give systems time to move to 0.16.3 or 0.17.0rc4. Over half the hashrate is believed patched, no exploit attempts are known, and affected users are urged to upgrade.
Tags
- CVE
- Mining
More from Bitcoin Core
Slow unbounded memory growth on paused pre-BIP31 peers
By pretending not to support BIP 31 pings, a malicious peer could dodge the 20-minute disconnect and read slowly, swelling a node's send queue by up to 2MB per hour for each inbound peer and 5MB for each outbound one. CVE-2026-117349, rated Medium, is fixed by #36667 in Bitcoin Core 32.1, 31.2, 30.4 and 29.5; -blocksonly nodes were much less exposed.
Bitcoin Core
Bitcoin Core 30.4 released
Bitcoin Core 30.4 stops treating BIP 9 bits 5 to 28 as soft fork signals, following BIP 323, so blocks that set them no longer trigger unknown-deployment warnings (#34779). Network changes include a timeout enforced on paused send peers (#36667), and flatfile positions now use 64-bit integers (#36669).
Bitcoin Core
Unbounded memory growth through TCP urgent data on non-Linux systems
Windows, macOS and BSD nodes could be crashed by a connected peer sending TCP urgent data, which slipped past paused reads in the select() backend and queued memory without limit (CVE-2026-117350). Linux nodes use poll() and are not affected. Bitcoin Core 32.1, 31.2, 30.4 and 29.5 fix the Medium-severity bug, which an LLM scan under Project Loupe found.
Bitcoin Core