Bitcoin Core versions below 24.0.1 have a critical vulnerability affecting 17% of full nodes

ChainCatcher news, according to Protos, Bitcoin Core developers have issued a new high-risk warning, stating that one in every six Bitcoin nodes has a software vulnerability. On Thursday, the staff responsible for maintaining the open-source Bitcoin Core project, which runs on over 98% of reachable full nodes, disclosed that the software running on 17% of the nodes in the network has significant security issues. Specifically, all software versions below Bitcoin Core 24.0.1 are at risk. According to monitoring estimates from Bitnodes, this denial-of-service vulnerability affects approximately 3,330 of the 19,200 self-identified user agents of accessible Bitcoin full nodes.

In Bitcoin Core software prior to version 24.0.1, malicious actors could spam nodes with low-difficulty header chains. By forcing nodes to download and store extremely long header chains, the attack could crash nodes by consuming excessive bandwidth or device storage space. Developers fixed this vulnerability in Bitcoin Core pull request (PR) number 25717 and merged it into production with the release of v24.0.1 on December 12, 2022. The current version of Bitcoin Core node software (now 27.1) includes fixes for this vulnerability and others.

Although this vulnerability is quite serious, there are few known cases of attacks exploiting it in public records. The cost of generating and broadcasting block header chains to execute a denial-of-service attack is relatively high, making the vulnerability of little economic benefit to attackers.