Critical Vulnerability in Bitcoin Core Threatens Over 13% of Nodes

Bitcoin developers have announced a critical security flaw in Bitcoin Core that could leave over 13% of global nodes vulnerable to shutdown.

This vulnerability, known as CVE-2024-35202, affects all Core software versions prior to 25.0.

The issue arises from the compact block protocol, which is designed to reduce bandwidth usage by shortening transaction identifiers. An attacker could exploit this by causing a collision, leading a node to incorrectly assert it has received an entire block. This flaw allows the node to enter an invalid state, potentially crashing it.

Niklas Gögge, who discovered the issue, also created the fix, which has been included in Bitcoin Core version 25.0, released on May 26, 2023. According to BitNodes.io, around 13.7% of the 18,843 active nodes are still at risk, prompting developers to urge operators to update to version 28.0 to ensure security.

While the vulnerability does not provide immediate financial gains for attackers, it could be leveraged by entities aiming to disrupt Bitcoin operations. This incident underscores the importance of regular updates, as Bitcoin Core does not auto-update, requiring manual intervention from node operators to stay secure.