Back to KEVs

CVE-2023-50428

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code...

Basic Information

CVE State
PUBLISHED
Reserved Date
December 09, 2023
Published Date
December 09, 2023
Last Updated
August 02, 2024
Vendor
n/a
Product
n/a
Description
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."

CVSS Scores

CVSS v3.1

5.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploit Status

Exploited in the Wild
Yes (2023-12-09 00:00:00 UTC) Source

References

https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://twitter.com/LukeDashjr/status/1732204937466032285 https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799 https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md https://github.com/bitcoin/bitcoin/tags https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53

Known Exploited Vulnerability Information

Source Added Date
CVE 2023-12-09 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel