Description
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
References (4)
Core 4
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md
Vendor Advisory x_refsource_misc
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145
Exploit, Technical Description, Third Party Advisory x_refsource_confirm
https://invdos.net/paper/CVE-2018-17145.pdf
Third Party Advisory x_refsource_confirm
https://invdos.net
Scores
CVSS v3
7.5
EPSS
0.0341
EPSS Percentile
87.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (24)
bcoin/bcoin
< 1.0.2
bitcoin/bitcoin_core
0.16.0 - 0.16.2
bitcoinknots/bitcoin_knots
0.16.0 - 0.16.2
btcd_project/btcd
0.3.0 alpha
btcd_project/btcd
0.3.1 alpha
btcd_project/btcd
0.3.2 alpha
btcd_project/btcd
0.3.3 alpha
btcd_project/btcd
0.4.0 alpha
btcd_project/btcd
0.5.0 alpha
btcd_project/btcd
0.6.0 alpha
... and 14 more
Published
Sep 10, 2020
Tracked Since
Feb 18, 2026