CVE-2023-50428
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023.
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Affected
- bitcoin/bitcoin core · bitcoinknots/bitcoin knots
- Source
- cve@mitre.org
References
- https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_ExposuresThird Party Advisory
- https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53
- https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799Issue Tracking
- https://github.com/bitcoin/bitcoin/tagsProduct
- https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.mdRelease Notes
- https://twitter.com/LukeDashjr/status/1732204937466032285Issue Tracking, Third Party Advisory
- https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_ExposuresThird Party Advisory
- https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53
- https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799Issue Tracking
- https://github.com/bitcoin/bitcoin/tagsProduct
- https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.mdRelease Notes
- https://twitter.com/LukeDashjr/status/1732204937466032285Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.