CVE-2023-33297

HIGH EPSS 69.1%

Published May 22, 20233y ago · Modified Jun 17, 20261w ago

7.5 CVSS 3.1

High

Published May 22, 2023 3y ago

Last Modified Jun 17, 2026 1w ago

Description

Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

69.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 1

Vendor	Product	Version	Range
bitcoin	bitcoin_core	*	<24.1

References 10

en.bitcoin.it https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures

Not Applicable
github.com https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md

Release Notes
github.com https://github.com/bitcoin/bitcoin/issues/27586

Issue Tracking
github.com https://github.com/bitcoin/bitcoin/issues/27623

Issue Tracking
github.com https://github.com/bitcoin/bitcoin/pull/27610

Issue TrackingPatch
github.com https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544
github.com https://github.com/visualbasic6/drain
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2EI7SAP4QP2AJYK2JVEOO4GJ6DOBSM5/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3CQY277NWXY3RFCZCJ4VKT2P3ROACEJ/
x.com https://x.com/123456/status/1711601593399828530

Remediation

github.com https://github.com/bitcoin/bitcoin/pull/27610

Issue TrackingPatch